MediaTek GeniZone CVE-2026-20496

System-level privilege (android.uid.system or equivalent, distinct from root but above standard app privilege) is a hard prerequisite - the vulnerability cannot be reached from a normal or even privileged app context without a prior escalation. The vulnerable code path is in the geniezone kernel driver, which is only accessible from System-privileged processes. Limiting factors include: (1) the mandatory System privilege barrier, which requires its own exploit chain; (2) local access only - no network vector exists; (3) no user interaction required once System privilege is held, meaning it is usable silently in a post-compromise scenario. There is no indication that a specific non-default configuration or optional feature must be enabled - the geniezone driver is present on all 17 affected chipset models by default.

The CVSS base score of 4.4 accurately reflects a constrained vulnerability: AV:L requires physical or logical local access, and PR:H mandates that the attacker already hold System privilege - the highest Android user-space privilege level, typically attained only after a prior privilege escalation chain. This drastically limits the attack surface to post-compromise scenarios. EPSS at 0.14% (4th percentile) indicates that the broader security community does not anticipate near-term exploitation, consistent with the SSVC assessment of exploitation: none and automatable: no. Notably, there is a material discrepancy between the narrative description ('local information disclosure') and the CVSS vector (C:N/I:N/A:H): an out-of-bounds read should yield a Confidentiality impact, not an Availability impact. This inconsistency suggests a possible vendor CVSS authoring error and should be verified against the MediaTek August 2026 bulletin. The SSVC technical impact of 'partial' is consistent with a bounded information disclosure rather than a full system compromise. Overall, this is a real-but-low-urgency finding - meaningful in a post-exploitation context but not a standalone entry vector.

An attacker who has already escalated to Android System privilege on a device powered by one of the 17 affected MediaTek chipsets submits a crafted ioctl or memory request to the geniezone driver without valid bounds. The missing bounds check allows the read to extend beyond the intended buffer, potentially exposing adjacent memory contents to the caller. No public proof-of-concept code exists at the time of analysis, and this scenario requires a separate prior exploit chain to reach System privilege.