MediaTek Wi-Fi CVE-2026-20494

Exploitation requires that the attacker has already obtained Android System privilege (UID 'system') on the target device - a high-privilege level distinct from standard application context. This is a critical prerequisite that severely limits the realistic attacker population; gaining System privilege itself typically requires a separate exploit chain. The affected device must contain one of the specified MediaTek chipsets (MT6988, MT6990, MT6890). No user interaction is required once System privilege is held. Limiting factors include: the System privilege prerequisite (not achievable by standard Android apps), device-specific chipset requirement, and the read-only nature of the flaw (no write primitive, integrity and availability are not impacted). The CVSS vector records PR:L but the description states System privilege is required - PR:L should be treated as potentially inaccurate pending vendor confirmation.

The CVSS 3.1 base score of 5.5 (Medium) captures the local attack vector and high confidentiality impact, but the real-world risk is substantially tempered by multiple converging signals. EPSS places this at 0.13% exploitation probability in the 3rd percentile, reflecting the extremely high bar an attacker must clear - full System privilege on the target device - before this flaw becomes relevant. SSVC assesses exploitation status as none, automatable as no, and technical impact as partial, reinforcing a low operational priority. No CISA KEV listing and no public exploit code further reduce urgency. One important discrepancy: the official CVSS vector records PR:L (low privilege), yet the description explicitly states 'malicious actor has already obtained the System privilege' - System UID in Android is substantially more privileged than a standard app context and more accurately maps to PR:H. This inconsistency means the official score likely overstates exploitability ease; defenders should verify with MediaTek's advisory. Despite C:H in the vector, the cascading privilege requirement makes this a low operational priority unless combined with a privilege escalation chain.

An attacker who has already achieved System-level privilege on an Android device running affected MediaTek MT6988, MT6990, or MT6890 silicon - for example, through a separate privilege escalation exploit or malicious system application - invokes a Wi-Fi driver interface without proper bounds validation, triggering an out-of-bounds read. The read operation returns memory contents from adjacent kernel or driver memory regions, which may include sensitive data such as cryptographic key material, authentication tokens, or other in-memory secrets. No public proof-of-concept exploit code has been identified at time of analysis.