Is CVE-2026-20483 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20483 being exploited in the wild.

How severe is CVE-2026-20483?

High severity, with a CVSS score of 7.7, published 3 August 2026.

Is there a fix for CVE-2026-20483?

A patch was published on 2026-08: Security patches issued to OEMs at least 2 months prior to public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20483 attacked?

It is attacked with local access.

Am I affected by CVE-2026-20483?

Check whether you run MediaTek Mt6739, MediaTek Mt6739 Firmware, MediaTek Mt6761 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20483: MediaTek Telephony permission check bypass

CVE-2026-20483 · Severity: high · CVSS 7.7 · Published 2026-08-03

A telephony component in MediaTek chipsets lacks proper permission validation, allowing local attackers to escalate privileges without requiring additional system permissions or user interaction. This could enable unauthorized access to sensitive telephony functions and system resources on affected mobile devices and IoT products.

Quick answers

Is CVE-2026-20483 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20483 being exploited in the wild.
How severe is CVE-2026-20483?: High severity, with a CVSS score of 7.7, published 3 August 2026.
Which products and versions are affected?: MediaTek Telephony <UNKNOWN>.
Is there a fix for CVE-2026-20483?: A patch was published on 2026-08: Security patches issued to OEMs at least 2 months prior to public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20483 attacked?: It is attacked with local access.
Am I affected by CVE-2026-20483?: Check whether you run MediaTek Mt6739, MediaTek Mt6739 Firmware, MediaTek Mt6761 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability exists in the Telephony subcomponent of MediaTek chipsets due to missing permission checks, allowing privilege escalation. The attack is locally exploitable without requiring any additional execution privileges or user interaction. An attacker with local code execution can call telephony functions that should be restricted, elevating their privileges within the system. MediaTek has issued patches (Patch ID: ALPS11087526) and notified device OEMs at least two months prior to publication; no active exploitation in the wild has been reported.

Affected products

MediaTek Telephony <UNKNOWN>

Timeline

2026-08-03: disclosed
2026-08: patched: Security patches issued to OEMs at least 2 months prior to public disclosure

References

https://www.mediatek.com/product-security-bulletin/August-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.