MediaTek AIDL CVE-2026-20535

Exploitation requires that the attacker has ALREADY obtained the Android System privilege on the local device - this is the explicit precondition stated in the description and reflected by PR:H in the CVSS vector. The flaw is a missing permission check in the aidl component reachable from that System context; no user interaction is required (UI:N). Limiting factors: attack is local only (AV:L, no remote vector), there is no network-facing exposure, and the high System-privilege prerequisite means a standalone unprivileged app cannot trigger it directly - it is most relevant as the second stage of an exploit chain or for already-privileged malware. Affects MediaTek chipsets including MT6993, MT8188, MT6881, MT8793, MT6991, MT8668, MT6899, MT6989, MT8189, MT8781, MT6878, and MT8910.

This is a moderate, defense-in-depth issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U) and the description agree and reinforce each other: exploitation is local only and requires that the attacker ALREADY hold the System privilege (PR:H), after which a missing permission check (CWE-862) in aidl permits further escalation with full C:H/I:H/A:H impact on the device. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied in the input. There is no CISA KEV entry, so this is NOT confirmed as actively exploited. The high PR requirement is the dominant mitigating signal - an attacker must first compromise a highly privileged (System) context, which substantially narrows the realistic attacker population to malware or a chained exploit that has already achieved System access. The 6.7 base score is consistent with 'serious if reached, but gated behind a significant precondition.' No signals conflict; the main gap is the absence of exploitation-probability (EPSS) and exploit-availability data, so prioritization should treat this as a routine patch-cycle item unless the device is part of a threat model where System-level compromise is plausible.

Malware or a previously-chained exploit that has already gained the Android System privilege on a MediaTek-powered device invokes an aidl interface that fails to perform a required permission check. Because no user interaction is needed, the code silently escalates from System to a higher-privileged context, gaining full read/write/availability control. No public exploit was identified in the provided data, so this reflects the attack path implied by the CVSS vector and description rather than a demonstrated exploit.