MediaTek Bluetooth EUVD-2026-52085

The attacker must hold a valid low-privilege (standard user) local account on the target system - remote or unauthenticated exploitation is excluded by the AV:L/PR:L CVSS vector. The target device must be equipped with one of the six specific MediaTek chipsets (MT7902, MT7920, MT7921, MT7922, MT7925, MT7927) and must have the vulnerable Bluetooth driver loaded and active in the kernel. No non-default configuration is required beyond the driver being present, which is the default state on any device shipping these chipsets with Bluetooth enabled. Exploitation is constrained by: (1) requirement for an existing authenticated local session - attackers without prior foothold cannot trigger this remotely; (2) the vulnerability is not automatable per SSVC, meaning mass exploitation at scale is not practical; (3) scope is unchanged (S:U), so impact is confined to the single compromised device rather than propagating laterally through a network.

The CVSS 7.8 HIGH score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the per-device severity: once a low-privilege user is present, exploitation requires no special conditions and yields full system compromise. However, real-world organizational risk is substantially lower than the raw score implies. The attack vector is strictly local (AV:L), excluding any remote or network-based exploitation path, which sharply limits the attacker population to those who already hold a foothold or have physical access. EPSS at 0.15% (5th percentile) reflects near-zero current exploitation probability. SSVC rates exploitation as 'none' and technical impact as 'partial' - the 'partial' technical impact rating is worth noting, as it partially conflicts with the CVSS C:H/I:H/A:H triad; this likely reflects SSVC's broader ecosystem scope assessment (scope unchanged, one device affected) rather than a per-device impact disagreement. The vulnerability is not listed in CISA KEV and no POC code has been identified. Priority: apply vendor patch during normal maintenance cycles, escalating only for multi-tenant or shared-access device environments where untrusted local users are realistic threat actors.

An attacker who has obtained a standard (low-privilege) user session on a device equipped with an affected MediaTek chipset - via phishing, credential theft, or a prior low-severity vulnerability - directly invokes a restricted Bluetooth driver interface. Because the driver omits the required permission check, the call succeeds and the attacker's process is elevated to a higher privilege level, enabling access to protected OS resources or persistence mechanisms. No public exploit code is known, and no user interaction from a victim beyond the attacker's initial access is required.