MediaTek Chipset CVE-2026-20474

Exploitation requires the attacker to already hold System-level privilege on the local device (PR:H confirmed by CVSS vector) - this is not a remote or unauthenticated attack path. The vulnerability is specific to the display driver subsystem; the affected device must be running one of the 17 listed MediaTek chipsets (MT6991, MT8768, MT8678, MT8799, MT8189, MT8781, MT6993, MT8367, MT8791T, MT8766, MT8188, MT8910, MT8676, MT8786, MT8126, MT8171, MT8668). No user interaction is required once System access is established (UI:N). The critical limiting factor is the System privilege prerequisite - the attacker must chain this with a separate, prior vulnerability or misconfiguration to first reach that privilege level. Standard Android sandboxing, SELinux enforcement, and verified boot reduce the realistic likelihood of reaching the required starting state.

The CVSS base score of 6.0 reflects a meaningful but context-constrained flaw. The vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N confirms that exploitation is local-only and requires the attacker to already hold System-level access - a significant prerequisite that substantially limits the realistic attacker population. Despite AC:L in the vendor-assigned vector, the underlying CWE-367 race condition intrinsically involves timing dependency, suggesting real-world exploitation complexity may be higher than the score implies. The EPSS score of 0.11% (2nd percentile) corroborates low exploitation likelihood. There is no CISA KEV listing and no known public POC, making this a low-urgency issue in isolation. The primary risk scenario is as a second-stage privilege escalation chained after an initial System-level compromise - not a standalone entry-point attack. The high confidentiality and integrity impact (C:H/I:H) is notable but only materializes after a prior compromise. Defenders should prioritize this as a patch-and-move-on item rather than an emergency response.

An attacker who has already compromised a process running at Android System privilege on a device equipped with an affected MediaTek chipset targets the display driver's TOCTOU window - racing a concurrent thread to modify a shared resource between the check and use operations. By winning the race, the attacker redirects execution or corrupts kernel state within the display subsystem, elevating privileges beyond System level and gaining read/write access to otherwise protected memory regions or credentials. No public exploit code is known at time of analysis.