EUVD-2026-33543
GHSA-fr72-6536-5mwp
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (MediaTek) · only source for this CVE.
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6786.
AnalysisAI
Local privilege escalation in MediaTek's GenieZone hypervisor component affects 36 distinct chipsets via a race condition-induced out-of-bounds write. An attacker who has already obtained System-level privilege on an affected Android device can exploit the TOCTOU flaw to escalate further - likely to kernel or hypervisor-level execution - achieving full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the wide chipset footprint spanning flagship to budget SoCs significantly broadens the potential attack surface.
Technical ContextAI
GenieZone is MediaTek's hardware-assisted virtualization and Trusted Execution Environment (TEE) hypervisor framework embedded in its SoC family. The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use / TOCTOU race condition), meaning a shared resource is checked and then used in separate, non-atomic operations, creating a window for a concurrent thread or process to alter the resource between those two operations. The result is an out-of-bounds write - memory beyond an intended buffer boundary is overwritten - which in a hypervisor context can corrupt control structures, page tables, or execution state. The affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset across a broad range of SoC models spanning Android flagship, mid-range, and budget segments. The high attack complexity (AC:H) directly reflects the probabilistic nature of winning a race condition, which requires precise timing or repeated attempts.
RemediationAI
The vendor-supplied patch is identified by Patch ID ALPS10873936 (Issue ID MSV-6786) and is documented in the MediaTek Product Security Bulletin for June 2026 at https://corp.mediatek.com/product-security-bulletin/June-2026. OEM and ODM device manufacturers must integrate this patch into their Android security update pipelines and push OTA updates to affected devices. End users should apply the latest available security patch level for their device as soon as it is released by their device manufacturer. Because the vulnerability requires System-level privilege as a prerequisite, compensating controls that limit the ability to obtain System privilege - such as enforcing SELinux enforcing mode, restricting sideloading of privileged applications, and applying Android's verified boot - will materially reduce exploitation risk in the absence of a device-specific OTA patch. Disabling developer options and ADB on production devices removes additional privilege escalation pathways that could feed this attack. Note that SELinux policies alone do not patch the race condition but do reduce the probability that an attacker can reach System privilege in the first place.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today