CVE-2026-20514: CWE-307 Improper Restriction of Excessive Authentication Attempts in MediaTek, Inc. MediaTek chipset

This vulnerability involves improper restriction of excessive authentication attempts (CWE-307) in the Audio HAL of MediaTek chipsets. Due to a missing permission check, a malicious actor with System privilege could disclose local information without user interaction. The issue is identified by MediaTek as MSV-8244 with patch ID ALPS11087632, but no public patch or remediation details have been provided. The affected chipsets include a broad range of MediaTek models explicitly enumerated in the input data.

The impact is limited to local information disclosure and requires the attacker to have already obtained System privilege on the device. There is no indication of remote exploitation or privilege escalation from this vulnerability alone. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users and administrators should monitor MediaTek advisories for updates. No specific mitigation steps are indicated in the provided data.