MediaTek Chipset CVE-2026-20473

Exploitation requires the attacker to already possess System-level privileges on the target Android device - this is explicitly stated in the CVE description and corroborated by the CVSS PR:H metric. System privilege in Android sits above standard application execution but below kernel/root; this vulnerability enables escalation to a higher tier from that starting point. The vulnerable code path is within the display driver component; no additional configuration, feature flag, or non-default setting is described as a prerequisite. No user interaction is required (UI:N) once System access is established. The attack is strictly local (AV:L) and cannot be triggered remotely or by an unprivileged or network-accessible attacker. Devices must use one of the 17 listed MediaTek chipsets. The high privilege prerequisite (PR:H) is the dominant factor limiting real-world exploitation risk.

The CVSS 3.1 score of 6.0 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N accurately reflects that this is a post-compromise, local privilege escalation - not an initial access vector. The most significant limiting factor is PR:H: the attacker must already control the System privilege tier on the target device before triggering this flaw. EPSS at 0.14% (4th percentile) confirms extremely low exploitation probability, and the absence of a KEV listing indicates no confirmed active exploitation. The C:H/I:H impact scores are meaningful in the context of kernel escalation (memory read/write primitives), but the AV:L constraint substantially caps real-world risk - this vulnerability is a secondary link in an exploit chain, not a standalone critical threat. There is no conflict between the CVSS vector and the description; both consistently indicate local, high-privilege exploitation. The additional tags (Denial of Service, Buffer Overflow) are not corroborated by the authoritative CWE-416 classification and may reflect metadata over-labeling.

An attacker who has already obtained System-level privileges on an Android device powered by an affected MediaTek chipset - for instance, through a separate application-layer or framework vulnerability - interacts with the display driver to trigger the use-after-free condition, corrupting freed kernel memory to overwrite critical structures and escalate to kernel or root access. No public exploit code is currently available, making opportunistic exploitation highly unlikely. This flaw is most relevant as a second-stage component in a multi-step privilege escalation chain targeting Android devices.