MediaTek HFRP CVE-2026-20485

Exploitation requires local access to a device running the MediaTek MT6993 chipset and, critically, the attacker must have already obtained Android System-level privilege (UID 'system') prior to targeting HFRP - this is explicitly stated in the CVE description and is reflected in CVSS PR:H. This is not an initial-access vulnerability; it is a privilege escalation primitive usable only post-compromise. No user interaction is required once System privilege is held. Exploitation is limited to physical or logical local access (AV:L); remote exploitation is not possible without a separate preceding vulnerability granting local code execution at System privilege. The vulnerability is hardware-specific and only affects devices incorporating the MT6993 SoC.

The CVSS 3.1 base score of 6.0 with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N accurately captures the constrained threat profile: local access and pre-existing System-level privilege are mandatory prerequisites, sharply limiting the exploitable population. EPSS at 0.13% (3rd percentile) corroborates SSVC's 'exploitation: none' designation - this is not attracting active attacker interest at time of analysis. Despite these limiting factors, SSVC's 'Technical Impact: total' rating reflects that successful exploitation yields full memory read/write at a higher privilege tier, a significant capability in a post-compromise scenario. This vulnerability is best categorized as a privilege escalation stepping-stone rather than a standalone high-risk exposure: it matters in the context of an exploit chain where System privilege has already been obtained via another vulnerability. The absence of availability impact (A:N) suggests the attacker goal is covert persistence or data exfiltration rather than disruption.

An attacker who has already compromised an Android application or service running at the 'system' UID - for example, via a separate vulnerability in a privileged system service - sends a specially crafted input to the HFRP component on a MT6993 device. The missing bounds check causes an out-of-bounds write that corrupts adjacent memory structures, allowing the attacker to elevate from System to root or kernel context and gain persistent, high-privilege access to the device. No public proof-of-concept exploit has been identified at time of analysis.