17 New Android Vulnerabilities - 17 High Severity, 3 With POC

Missing permission checks in the MediaTek GPU pdma driver, paired with a use-after-free, allow local privilege escalation on MT8910 and MT6993 chipsets: code running without privileges can reach the pdma interface and gain elevated execution with no user interaction and no additional execution privileges. MediaTek assigned patch ALPS11365075 (issue MSV-9546) and published it in the November 2026 product security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and SSVC records exploitation as none and the flaw as not automatable, but the total technical impact and CVSS 8.4 severity support this-week rather than emergency-grade prioritization, since the vector is local-only and confined to the listed chipset models.

Local privilege escalation in the MediaTek GPU pdma kernel driver allows a process already running with user-level privileges on a device built on an affected MediaTek chipset (EUVD lists MT8910 and MT6993) to corrupt kernel memory via a use-after-free and elevate to higher privileges; the flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction beyond the attacker's existing local code execution. The attacker must already have local code running on the device and the device must use one of the affected chipsets, so there is no remote vector, and no public exploit code or active exploitation has been identified at time of analysis. MediaTek has assigned Patch ID ALPS11365081 (Issue MSV-9545), with fixes delivered to device makers through the November 2026 product security bulletin.