CVE-2026-20484: MediaTek TFA information disclosure due to missing permission check
CVE-2026-20484 · Severity: medium · CVSS 4.4 · Published 2026-08-03
MediaTek's TFA (Trusted Firmware-A) component is a critical low-level software that manages system security and access control. A flaw in this component fails to properly verify permissions before disclosing sensitive system information, allowing an attacker with System privilege to read confidential data. Although exploitation requires prior privilege escalation, the exposure of system information could enable further attacks or reveal sensitive operational details.
No. Junglewise Threat Intelligence has no report of CVE-2026-20484 being exploited in the wild.
How severe is CVE-2026-20484?
Medium severity, with a CVSS score of 4.4, published 3 August 2026.
Which products and versions are affected?
MediaTek TFA (Trusted Firmware-A).
Is there a fix for CVE-2026-20484?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20484 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-20484?
Check whether you run MediaTek Mt6739, MediaTek Mt6739 Firmware, MediaTek Mt6761 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is classified as an information disclosure flaw resulting from a missing permission check in the TFA subcomponent. An attacker who has already obtained System privilege can bypass access controls and retrieve restricted system information without requiring user interaction. The missing authorization validation allows unauthorized exposure of sensitive data that should be protected. The vulnerability is tracked by MediaTek as Issue ID MSV-8004 and has been assigned Patch ID ALPS11053160. No active exploitation in the wild has been reported as of the advisory date.