CVE-2026-20495 - Vulnerability Details - OpenCVE

In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mediatek, Inc.	Mediatek Chipset

No data.

No data.

References

Link	Providers
https://www.mediatek.com/product-security-bulletin/August-2026

History

Mon, 03 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 03 Aug 2026 09:15:00 +0000

Type	Values Removed	Values Added
Title		Bluetooth Driver Permission Check Race Condition Leading to Local Privilege Escalation

Mon, 03 Aug 2026 04:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mediatek, Inc. Mediatek, Inc. mediatek Chipset
Vendors & Products		Mediatek, Inc. Mediatek, Inc. mediatek Chipset

Mon, 03 Aug 2026 02:45:00 +0000

Type	Values Removed	Values Added
Description		In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296.
Weaknesses		CWE-862
References		https://www.mediatek.com/product-security-bulletin/August-2026

MITRE

Status: PUBLISHED

Assigner: MediaTek

Published: 2026-08-03T02:06:03.350Z

Updated: 2026-08-03T18:56:33.932Z

Reserved: 2025-11-03T01:30:59.026Z

Link: CVE-2026-20495

Vulnrichment

Updated: 2026-08-03T18:56:30.235Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20495", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2025-11-03T01:30:59.026Z", "datePublished": "2026-08-03T02:06:03.350Z", "dateUpdated": "2026-08-03T18:56:33.932Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-08-03T02:06:03.350Z"}, "descriptions": [{"lang": "en", "value": "In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "defaultStatus": "unaffected", "versions": [{"version": "MT7902", "status": "affected"}, {"version": "MT7920", "status": "affected"}, {"version": "MT7921", "status": "affected"}, {"version": "MT7922", "status": "affected"}, {"version": "MT7925", "status": "affected"}, {"version": "MT7927", "status": "affected"}]}], "references": [{"url": "https://www.mediatek.com/product-security-bulletin/August-2026"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T18:56:07.604070Z", "id": "CVE-2026-20495", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T18:56:33.932Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20495", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2025-11-03T01:30:59.026Z", "datePublished": "2026-08-03T02:06:03.350Z", "dateUpdated": "2026-08-03T18:56:33.932Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-08-03T02:06:03.350Z"}, "descriptions": [{"lang": "en", "value": "In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "defaultStatus": "unaffected", "versions": [{"version": "MT7902", "status": "affected"}, {"version": "MT7920", "status": "affected"}, {"version": "MT7921", "status": "affected"}, {"version": "MT7922", "status": "affected"}, {"version": "MT7925", "status": "affected"}, {"version": "MT7927", "status": "affected"}]}], "references": [{"url": "https://www.mediatek.com/product-security-bulletin/August-2026"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-20495", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T18:56:07.604070Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T18:56:30.235Z"}}]}}