MediaTek TFA CVE-2026-20484

Exploitation requires that the attacker already holds System-level privilege on the target device - this is the primary and most significant limiting factor. The missing permission check in the TFA component fails to enforce authorization boundaries on callers operating at System privilege, allowing them to retrieve information intended only for higher-privilege or secure-world contexts. The affected device must contain one of the 39 listed MediaTek chipsets (MT6xxx or MT8xxx series). No network access, user interaction, non-default configuration, or specific runtime state beyond the pre-obtained System privilege is required. The flaw does not itself provide privilege escalation - it is only reachable after escalation has been achieved through a separate means. Remote exploitation is not possible (AV:L). This vulnerability is most relevant as a post-exploitation data-harvesting step within a broader attack chain, not as an initial access or escalation primitive.

The vendor-assigned CVSS 4.4 (Medium) is well-calibrated for this vulnerability. The CVSS vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N confirms the attack is entirely local, requires no complexity to trigger once prerequisites are met, but demands that System-level privilege has already been obtained - a substantial prerequisite. EPSS at 0.14% (4th percentile) strongly corroborates that real-world exploitation remains rare; this flaw cannot be reached remotely and has no standalone escalation utility. There is no CISA KEV listing and no known proof-of-concept. The C:H rating reflects that TFA handles sensitive material (keys, attestation data), making the disclosure meaningful in a post-compromise scenario, but the PR:H requirement means this is a secondary-stage tool for an already deeply-rooted attacker rather than an entry point. No conflicts exist between the CVSS vector, the description, and the EPSS signal - all consistently point to a constrained, low-probability exploitation scenario.

An attacker who has first escalated to System privilege on a MediaTek-powered Android device through a separate vulnerability or rooting method invokes the affected TFA interface, bypassing the absent permission check and retrieving sensitive secure-world information - such as cryptographic material or TEE attestation data - without any user interaction. No proof-of-concept code is publicly available at time of analysis, and the mandatory prior privilege escalation significantly limits opportunistic exploitation.