MediaTek Battery CVE-2026-20529

Exploitation requires the attacker to already hold the System privilege on an affected MediaTek-chipset device (PR:H); it is a local-only escalation (AV:L) reachable by invoking the vulnerable battery component, which performs a write without a required bounds check. No user interaction is needed once System access is held (UI:N), and the issue is reachable in default configurations of the listed chipsets (e.g., MT6765, MT6768, MT6893, MT6991, MT8188, MT8196 and others). The principal limiting factor is the high pre-existing privilege requirement: an attacker without System-level access cannot reach the flaw, so it functions as a post-compromise escalation rather than an initial foothold.

This is a genuine but constrained local privilege-escalation issue rather than a top-tier emergency. The CVSS 3.1 base score of 6.7 (MEDIUM) is driven by an out-of-bounds write (CWE-787) with AV:L (local), AC:L (low complexity), UI:N (no user interaction) and full C:H/I:H/A:H impact, but the decisive limiter is PR:H - the description explicitly states the attacker must 'already have obtained the System privilege.' This means the flaw is a privilege-escalation steppingstone (from System up to kernel/root), not an initial-access vector, so it only matters after an attacker has already achieved significant compromise. No EPSS score, SSVC decision, KEV listing, or POC indicator is present in the supplied data: there is therefore no public exploit identified at time of analysis and no evidence of active exploitation. All signals are internally consistent (vendor-authored CVSS from MediaTek matches the local, high-privilege description), so there is no conflict to flag - the main caveat is simply that real-world risk hinges entirely on the attacker first holding the System privilege, which substantially narrows the practical threat.

An attacker who has already compromised an Android device to the point of holding the System privilege (e.g., via a malicious system-context app or a prior exploit) invokes the vulnerable battery interface with crafted input that triggers a missing bounds check. The resulting out-of-bounds write corrupts adjacent memory in the privileged battery component, allowing escalation from System to kernel-level control without any user interaction. No public proof-of-concept is available at time of analysis.