This vulnerability (CVE-2026-20467) affects MediaTek chipsets MT8195, MT8196, and MT8366. It arises from a missing bounds check in the apusys component, which could lead to local privilege escalation if an attacker already has System-level access. No user interaction is required for exploitation. The CVSS 3.1 base score is 6.0 (medium), reflecting the need for prior elevated privileges and low attack complexity. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker who already has System privileges on the affected MediaTek chipsets could exploit this vulnerability to escalate their privileges further, potentially gaining higher-level control over the system. Confidentiality and integrity impacts are rated high, but availability is not affected. Since local System privileges are required, the vulnerability does not enable initial system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, limit access to systems with these chipsets to trusted users with System privileges to reduce risk.