EUVD-2026-33544
GHSA-jf3x-c8h2-5gjj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise Android privileged process to gain System UID
-
DeliveryOpen handle to GenieZone TEE interface
-
ExploitIssue crafted request triggering missing bounds check
-
ExecutionOut-of-bounds write corrupts GenieZone memory
-
PersistHijack TEE execution at higher trust level
-
ImpactExfiltrate keystore/DRM secrets or persist in TEE
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on the device with System-level privilege already obtained, as the GenieZone interface invoked by this flaw is reachable only from privileged system context - meaning the attacker must first compromise an Android system_server-class process or an OEM/MediaTek-signed privileged app. User interaction is not required (UI:N), and the attack is local-only (AV:L), so remote network exploitation is not possible without a separate initial-access primitive. Exploitation is further limited to devices using one of the listed MediaTek SoCs (MT6xxx/MT8xxx series) that ship the GenieZone TEE; non-MediaTek devices and MediaTek chipsets without GenieZone are unaffected. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates local attack vector, low complexity, low privileges required, and high impact across all three security properties, yielding a base score of 7.8. However, MediaTek's own description explicitly states that exploitation requires the attacker to have already obtained System privilege - a higher bar than the PR:L the CVSS vector suggests, so there is a mild conflict between CVSS PR:L and the textual prerequisite of System-level access (verify with vendor). No EPSS score, KEV listing, or public PoC is available, so this is best treated as a privilege-boundary hardening fix rather than an imminent mass-exploitation risk. The realistic threat is post-compromise escalation by malicious apps or chained exploits aiming to break out of Android into TEE, which is a meaningful concern for high-value targets (banking, DRM, enterprise MDM) even though it is not a widespread internet-facing risk. |
| Exploit ScenarioDerived | An attacker who has already compromised a privileged Android system process (for example, via a separate vendor-service vulnerability or a malicious OEM-signed app) issues a crafted call into the GenieZone TEE interface that triggers the missing bounds check, writing attacker-controlled data out of bounds inside the TEE. Successful exploitation lets the attacker corrupt TEE state to gain code execution at the GenieZone trust level, breaking isolation for keystore material, DRM secrets, or biometric templates. No public PoC is identified at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 01, 2026
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gained System-level privileges on an affected device to write out-of-bounds memory and escalate further on the chipset. The flaw affects a broad range of MediaTek chipsets used in mobile and embedded devices, with no public exploit identified at time of analysis. CVSS is 7.8 (High) reflecting the high integrity, confidentiality, and availability impact despite the local attack vector.
RemediationAI
Apply the MediaTek-supplied fix tracked as Patch ID ALPS10873936 (Issue ID MSV-6784) as integrated by your device OEM in the June 2026 Android security level or later vendor firmware update - see https://corp.mediatek.com/product-security-bulletin/June-2026. Because TEE fixes ship through the device manufacturer's firmware/OTA pipeline rather than directly from MediaTek, end users and fleet operators should track their OEM's security bulletin (Samsung, Xiaomi, Oppo, etc.) and force-install the corresponding monthly patch. As a compensating control until firmware is available, restrict the ability of apps to attain System privilege by enforcing strict MDM-controlled app allow-listing, disabling sideloading, and removing unnecessary privileged system apps; note this only reduces the attack surface that could reach the GenieZone interface and does not remove the vulnerability itself.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GenieZone is MediaTek's proprietary Trusted Execution Environment (TEE) hypervisor, isolating sensitive workloads (DRM, key storage, biometrics) from the Android Rich Execution Environment. The root cause is CWE-787 (Out-of-bounds Write) caused by a missing bounds check in a GenieZone code path reachable from a privileged caller. Because GenieZone runs at a higher privilege boundary than the Android OS, corrupting its memory can break the security guarantees the TEE provides to the rest of the system. The affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset, spanning dozens of MT6xxx/MT8xxx SoCs (e.g. MT6991, MT8798, MT6989) used in Android phones and tablets.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (MediaTek) · only source for this CVE.
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6784.
Executive ViewAI
CVE-2026-20455 affects the trusted execution environment of MediaTek chipsets widely deployed in organizational mobile and embedded devices, allowing attackers with initial system-level access to escalate privileges and compromise device integrity and data confidentiality. The vulnerability poses a critical chain-attack risk: any device compromise that reaches system-level execution can now progress to complete TEE control, bypassing security boundaries intended to protect sensitive operations.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce application whitelisting and restrict system-privilege elevation on affected devices; implement device-level audit logging to detect privilege escalation attempts; segment MediaTek-based devices on isolated network zones where feasible; maintain device inventory for immediate deployment of patches upon vendor release; monitor for indicators of system-level compromise targeting TEE.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in geniezone Out-of-Bounds Write and Race Condition
View all 3More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to
Exploit-DB