MediaTek meta CVE-2026-20544

Exploitation requires direct physical access to an affected MediaTek-chipset device (AV:P) and interaction with the 'meta' component, which contains a missing bounds check leading to an out-of-bounds write (CWE-787). No authentication, pre-existing execution privileges, or user interaction are required once physical access is obtained (PR:N/UI:N). The dominant limiting factor is the physical-access prerequisite, which prevents remote or network-based exploitation and confines realistic abuse to scenarios such as lost/stolen devices, border or forensic inspection, or pre-delivery supply-chain tampering. Affected devices are limited to those built on the listed MediaTek chipsets (e.g., MT6789, MT6895, MT6985, MT8195) and remediated by patch ALPS11049530 / ALPS11480843.

This is a genuine but low-urgency vulnerability for most defenders. The CVSS 3.1 base score of 6.8 (Medium) is driven by high confidentiality, integrity, and availability impact (C:H/I:H/A:H) combined with low attack complexity and no privilege or user-interaction requirements - but the single most important mitigating signal is the Physical attack vector (AV:P), confirmed by both the CVSS vector and the description ('if an attacker has physical access to the device'). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or opportunistic exploitation. The SSVC exploitation status is therefore 'none', and because physical access is required the threat is inherently non-automatable and not suitable for remote mass exploitation. Signals are internally consistent - the high-impact-but-physical profile points to a targeted, hands-on-device threat (e.g., device theft, forensic/evidence tampering, or supply-chain tampering) rather than a widespread remote risk. Note: although PR:N technically means no authentication, the AV:P requirement is the real gating factor; treat this as a physical-access escalation, not a remotely exploitable flaw.

An attacker with physical possession of an affected MediaTek-powered device interacts with the vulnerable 'meta' component, supplying malformed input that overflows a buffer due to the missing bounds check. The resulting out-of-bounds write corrupts adjacent memory to escalate privileges locally, without needing any existing execution privileges or user interaction. No public exploit code has been identified at time of analysis.