Junglewise Threat Intelligence
CVE-2026-20483: MediaTek Telephony permission check bypass
CVE-2026-20483 · Severity: high · CVSS 7.7 · Published 2026-08-03
Technologies: MediaTek Mt8873 Firmware, MediaTek Mt6878 Firmware, MediaTek Mt6895 Firmware, MediaTek MT8883, MediaTek Mt6879, MediaTek Mt6768 Firmware, MediaTek Mt6885, MediaTek Mt6989 Firmware, MediaTek Mt6886, MediaTek MT8873, MediaTek Mt6835 Firmware, MediaTek Mt6855 Firmware, MediaTek Mt6883, MediaTek Mt6993 Firmware, MediaTek Mt6789 Firmware, MediaTek Mt6878, MediaTek Mt6765, MediaTek Mt6991, MediaTek Mt6879 Firmware, MediaTek Mt8775 Firmware, MediaTek MT6993, MediaTek Mt6855, MediaTek Mt6877 Firmware, MediaTek Mt6897, MediaTek Mt6789, MediaTek Mt6761, MediaTek Mt6877, MediaTek Mt6985 Firmware, MediaTek MT8792, MediaTek Mt8766, MediaTek Mt6897 Firmware, MediaTek Mt6833 Firmware, MediaTek Mt6853 Firmware, MediaTek Mt6835, MediaTek MT8775, MediaTek Mt6889, MediaTek Mt8766 Firmware, MediaTek Mt8796 Firmware, MediaTek Mt6853, MediaTek Mt6886 Firmware, MediaTek Mt6983 Firmware, MediaTek Mt6761 Firmware, MediaTek Mt6991 Firmware, MediaTek MT8893, MediaTek Mt6765 Firmware, MediaTek Mt6889 Firmware, MediaTek Mt8792 Firmware, MediaTek Mt8781, MediaTek MT8796, MediaTek MT6833, MediaTek Mt6895, MediaTek Mt6781 Firmware, MediaTek Mt6739 Firmware, MediaTek Mt6739, MediaTek Mt6985, MediaTek Mt8781 Firmware, MediaTek Mt6989, MediaTek Mt6893 Firmware, MediaTek Mt6781, MediaTek Mt6768, MediaTek Mt8883 Firmware, MediaTek Mt6893, MediaTek Mt6883 Firmware, MediaTek Mt8768 Firmware, MediaTek Mt6983, MediaTek Mt6885 Firmware, MediaTek Mt8768. Vendors: MediaTek.
Executive brief
A telephony component in MediaTek chipsets lacks proper permission validation, allowing local attackers to escalate privileges without requiring additional system permissions or user interaction. This could enable unauthorized access to sensitive telephony functions and system resources on affected mobile devices and IoT products.
Technical details
This vulnerability exists in the Telephony subcomponent of MediaTek chipsets due to missing permission checks, allowing privilege escalation. The attack is locally exploitable without requiring any additional execution privileges or user interaction. An attacker with local code execution can call telephony functions that should be restricted, elevating their privileges within the system. MediaTek has issued patches (Patch ID: ALPS11087526) and notified device OEMs at least two months prior to publication; no active exploitation in the wild has been reported.
Affected products
- MediaTek Telephony <UNKNOWN>
Timeline
- 2026-08-03: disclosed
- 2026-08: patched: Security patches issued to OEMs at least 2 months prior to public disclosure