This vulnerability (CVE-2026-20494) involves an out-of-bounds read (CWE-125) in MediaTek WiFi chipset models MT6890, MT6988, and MT6990. The root cause is a missing bounds check that could lead to local information disclosure. Exploitation requires the attacker to have System-level privileges but does not require user interaction. No official remediation level or patch information is provided in the available data. The CVSS 3.1 vector indicates low attack complexity and privileges required, with a high impact on confidentiality but no impact on integrity or availability.

An attacker with System privileges on affected MediaTek chipsets could exploit this vulnerability to read memory out of bounds, potentially disclosing sensitive information locally. There is no indication of remote exploitation or impact on system integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users should monitor MediaTek advisories for updates. Because exploitation requires System privileges, limiting local access and privilege escalation risks may reduce exposure until a patch is available.