MediaTek Chipset CVE-2026-20475

Exploitation requires the attacker to have already obtained System-level privilege on the targeted device (PR:H), making this a post-compromise escalation technique rather than an initial access vector. The attack is local (AV:L), meaning the attacker must have code execution on the device. No user interaction is required (UI:N). The vulnerable component is the display subsystem; no specific non-default configuration setting is required beyond having System privilege. Key limiting factors: the System privilege prerequisite is a substantial barrier on Android's privilege model; the attack surface is restricted to local device access only; and no automation of exploitation is feasible per SSVC (Automatable: no), suggesting manual or targeted exploitation chains are the realistic threat model.

The CVSS base score of 6.0 reflects the significant mitigating factor of PR:H - exploitation requires the attacker to have already achieved System-level privilege, which is a high bar on Android platforms. The AV:L local vector further limits exposure to device-local access only. Despite these constraints, SSVC classifies technical impact as 'total,' consistent with the C:H/I:H impact metrics. The very low EPSS score (0.14%, 4th percentile) and SSVC exploitation status of 'none' together indicate no observed or anticipated widespread exploitation. No conflict is detected between the CVSS vector and the description. The primary real-world risk is as a second-stage payload in a chained exploit: an attacker first gains System access through another vector, then uses this flaw to further escalate. Absent an active exploitation campaign, this is a moderate-priority patch for affected OEM/ODM partners rather than an emergency response item.

An attacker who has already compromised a MediaTek-based Android device to System-level privilege crafts a malicious display operation that triggers the missing bounds check, writing attacker-controlled data beyond the allocated buffer in the display subsystem. This memory corruption enables overwriting adjacent kernel structures or function pointers, potentially elevating execution context or compromising sensitive memory. No public exploit or proof-of-concept code has been identified at time of analysis.