CVE-2026-20495
Received Received - Intake

Bluetooth Driver Permission Bypass Leads to Privilege Escalation

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: MediaTek, Inc.

Description
In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-20495
EUVD
EUVD-2026-52085

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mediatek bluetooth_driver *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Bluetooth driver vulnerability where a missing permission check could allow local privilege escalation. Exploitation requires user execution privileges but no user interaction. The issue is tracked under Patch ID WCNCR00488300 and Issue ID MSV-7296.

Impact Analysis

An attacker with local access could exploit this to gain elevated privileges on a device using the affected Bluetooth driver. This may allow unauthorized system access or control.

Compliance Impact

This vulnerability involves a missing permission check in a Bluetooth driver, potentially allowing local privilege escalation. It does not directly impact compliance with standards like GDPR or HIPAA unless exploited to access sensitive data, which could lead to violations depending on context.

Mitigation Strategies

Apply the patch identified as WCNCR00488300 to the MediaTek Bluetooth driver to address the missing permission check. Ensure the patch is installed on all affected systems to prevent local privilege escalation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart