This vulnerability (CVE-2026-20484) involves the insertion of sensitive information into sent data due to a missing permission check in the TFA component of MediaTek chipsets. A malicious actor with System privilege could exploit this to disclose local sensitive information without needing user interaction. The issue affects a broad range of MediaTek chipset models explicitly listed. There is no CVSS score or vendor advisory indicating a patch or mitigation status at this time.

The impact is limited to local information disclosure, requiring the attacker to already have System-level privileges on the device. No remote exploitation or user interaction is needed. This could aid an attacker in gathering sensitive information from the device, potentially facilitating further attacks or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Users and administrators should monitor MediaTek advisories for updates and apply patches once available.