Skip to main content

MediaTek Bluetooth EUVDEUVD-2026-52085

| CVE-2026-20495 HIGH
Missing Authorization (CWE-862)
2026-08-03 MediaTek GHSA-854r-9p65-g453
7.8
CVSS 3.1 · Vendor: MediaTek
Share

Severity by source

Vendor (MediaTek) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only attack path (AV:L) requiring a user account (PR:L); no complexity barriers; full privilege escalation yields complete C/I/A impact on the device.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (MediaTek).

CVSS VectorVendor: MediaTek

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Aug 05, 2026 - 14:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 05, 2026 - 14:22 vuln.today
cvss_changed
Severity Changed
Aug 05, 2026 - 14:22 NVD
MEDIUM HIGH
CVSS changed
Aug 05, 2026 - 14:22 NVD
4.4 (MEDIUM) 7.8 (HIGH)
Analysis Generated
Aug 03, 2026 - 19:27 vuln.today
CVSS changed
Aug 03, 2026 - 19:22 NVD
4.4 (None) 4.4 (MEDIUM)
CVE Published
Aug 03, 2026 - 02:06 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296.

AnalysisAI

Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT7921, MT7922, MT7925, MT7927) due to a missing permission check (CWE-862) that allows a standard user-level process to invoke restricted driver operations. An attacker with low-privilege local access can fully compromise confidentiality, integrity, and availability of the affected system without any user interaction. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege local user session
Delivery
Invoke restricted Bluetooth driver interface
Exploit
Driver skips permission check (CWE-862)
Execution
Caller executes with elevated privileges
Impact
Access protected OS resources or install persistent mechanism

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid low-privilege (standard user) local account on the target system - remote or unauthenticated exploitation is excluded by the AV:L/PR:L CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 7.8 HIGH score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the per-device severity: once a low-privilege user is present, exploitation requires no special conditions and yields full system compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained a standard (low-privilege) user session on a device equipped with an affected MediaTek chipset - via phishing, credential theft, or a prior low-severity vulnerability - directly invokes a restricted Bluetooth driver interface. Because the driver omits the required permission check, the call succeeds and the attacker's process is elevated to a higher privilege level, enabling access to protected OS resources or persistence mechanisms. …
Remediation Apply the patch identified as WCNCR00488300 (MSV-7296), available through the MediaTek August 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/August-2026). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, begin asset discovery to identify all devices using MediaTek chipsets MT7902, MT7920, MT7921, MT7922, MT7925, or MT7927 across endpoints and network infrastructure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-20433 HIGH
8.8 Apr 07

Out-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont

CVE-2026-20465 HIGH
8.1 Aug 03

Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi

CVE-2026-20432 HIGH
8.0 Apr 07

Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con

CVE-2026-20452 HIGH
8.0 Jun 01

Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user

CVE-2026-20455 HIGH
7.8 Jun 01

Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain

CVE-2026-20483 HIGH
7.7 Aug 03

Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of

CVE-2026-20479 HIGH
7.5 Aug 03

Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment

CVE-2026-20458 HIGH
7.5 Jul 01

Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a

CVE-2026-20462 MEDIUM
6.7 Jul 01

Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr

CVE-2026-20463 MEDIUM
6.7 Jul 01

Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System

CVE-2026-20486 MEDIUM
6.7 Aug 03

Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets

CVE-2026-20453 MEDIUM
6.7 Jun 01

Local privilege escalation in MediaTek's geniezone hypervisor component affects 36 distinct chipsets spanning budget to

Share

EUVD-2026-52085 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy