MiracastService CVE-2026-20516

Exploitation requires a local attacker with user-level execution privileges (PR:L) already running code on a device built on one of the 29 affected MediaTek chipsets. The attack is confined to the local attack surface (AV:L); no network, adjacent-network, or remote exploitation path exists. MiracastService must be present and active on the platform - meaning the device must include the Miracast/Wi-Fi Display feature, which is standard on affected Smart TV and DTV chipsets. The confused deputy condition arises because MiracastService improperly exports an Android component (CWE-926), making it reachable by apps that lack the necessary permissions. No user interaction is required (UI:N). The impact is strictly limited to availability of MiracastService (A:H); there is no confidentiality or integrity impact possible through this vector. No non-default configuration is required to be vulnerable.

The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately frames this as a local denial-of-service requiring low user privileges - not a network-exploitable flaw. SSVC rates exploitation as none, automatable as no, and technical impact as partial, all consistent with the confined, non-exploited nature of this issue. There is no CISA KEV listing and no public POC, confirming the absence of observed active exploitation. The real-world risk is modest: impact is limited strictly to the availability of MiracastService (Wi-Fi Display) on affected devices, with no confidentiality or integrity consequences. A mid-sized consumer electronics operator in radom deploying MediaTek-based Smart TVs can reasonably include this in a scheduled OTA patch cycle rather than treating it as emergency remediation. The primary concern is for OEMs shipping affected chipsets, who should integrate the patch (ALPS11060069/DTV04881615) into their next firmware release.

A malicious application already installed on a MediaTek-chipset Smart TV or DTV device with standard user execution privileges sends a crafted IPC message or intent to the improperly exported MiracastService component. By exploiting the confused deputy condition, the calling app causes MiracastService to perform an operation that results in a service crash or sustained unavailability. The device's Miracast/Wi-Fi Display functionality is then disabled until the service is restarted or the device is rebooted, constituting a local denial of service. No public POC has been identified at time of analysis.