MediaTek imgsensor CVE-2026-20486

Exploitation requires the attacker to already hold System-level privilege on the target Android device - this is a pre-existing condition, not a condition the attacker can satisfy remotely. The vulnerable code path is within the imgsensor driver, so the camera subsystem or a process with access to its interfaces must be reachable from System context. The attack is local-only (AV:L), requires no user interaction (UI:N), and the complexity is low once System access is established (AC:L). What limits exploitation: the mandatory pre-requisite of System privilege rules out remote unauthenticated attackers and restricts this flaw to post-exploitation or insider threat scenarios; no network exposure is involved.

The CVSS 3.1 base score of 4.4 (Medium) is consistent with the high privilege prerequisite (PR:H) and local attack vector (AV:L), which significantly constrain exploitability. The EPSS score of 0.13% at the 3rd percentile reinforces that mass opportunistic exploitation is not anticipated. The vulnerability is not listed in the CISA KEV catalog and no public POC has been identified. However, there is a notable discrepancy: the CVSS vector records only Availability impact (A:H, C:N, I:N, S:U), yet the description explicitly states the crash 'could lead to local escalation of privilege' - an outcome that, if it reaches root or kernel space, would imply Integrity and Confidentiality impact as well. The vendor's conservative CVSS scoring may reflect uncertainty in the exploitation path to full privilege escalation. In practice, this flaw is most relevant as a second-stage or chained exploit for threat actors who have already achieved System-level access via another vulnerability, making it context-dependent rather than a standalone critical risk.

An attacker who has already compromised a MediaTek-based Android device to System privilege - for example, via a separate application vulnerability or a malicious app granted elevated permissions - sends a crafted call to the imgsensor kernel driver, triggering an unhandled error condition that crashes the target process. The improper error handling path then provides an opportunity to redirect execution flow or manipulate kernel state, escalating privileges beyond System toward root or kernel access. No public POC exists at time of analysis, and the practical exploitation complexity of the escalation step is not fully described in available data.