MediaTek GNSS CVE-2026-20551

Exploitation requires local access to the device and mandatory user interaction (CVSS AV:L and UI:R) targeting the gnss (GNSS/location) component on affected MediaTek chipsets (MT6990, MT6980D, MT2737, MT6982, MT6988, MT6986, MT6813). The flaw is a missing bounds check leading to an out-of-bounds write; the specific action or input that triggers the code path is not described in the available sources. Limiting factors that reduce real-world risk: the vulnerability is not remotely reachable, it cannot be exploited without user interaction, impact is confined to denial of service (no code execution, no data exposure - C:N/I:N/A:H), and no additional execution privileges are gained.

This is a medium-severity, locally-exploitable vulnerability that is NOT a top-tier emergency, and multiple independent signals agree on that assessment. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) shows the impact is limited to availability only (a denial of service) with no confidentiality or integrity loss, and crucially requires local access plus user interaction - it is not remotely reachable. CISA's SSVC framing reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial, which is consistent with a non-wormable, user-interaction-gated local DoS. The vuln.today priority of 'this_month' (not act_now/emergency) aligns with these signals. There is no KEV listing and no EPSS score supplied in the input, so no probabilistic exploitation estimate is available; absence of EPSS/KEV data is a gap, not evidence of safety, but combined with SSVC Exploitation=none there is no indication of active exploitation. No conflicting signals were found - the CVSS vector, SSVC, and vendor description all consistently describe a local, user-interaction-dependent out-of-bounds write causing denial of service with no privilege escalation.

A local attacker on an affected MediaTek-chipset device (or a malicious/compromised local app) induces the user to perform an action that drives the vulnerable gnss (GNSS/location) code path, triggering an out-of-bounds write from a missing bounds check and crashing the component, resulting in a local denial of service. No public exploit was identified at the time of analysis, and the attack cannot proceed without both local access and user interaction.