EUVD-2026-40875
GHSA-39rh-f5c6-gchq
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
System-level privilege is an explicit, confirmed prerequisite (PR:H); exploitation is local-only (AV:L); once conditions are met, AC:L and full C/I/A impact are consistent with a heap overflow yielding arbitrary code execution.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In Telephony, there is a possible memory corruption due to a heap buffer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11006447; Issue ID: MSV-7871.
AnalysisAI
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Android devices, delivering full confidentiality, integrity, and availability impact. Twenty-two specific MediaTek SoC variants are confirmed affected, spanning the MT6xxx and MT8xxx mid-range and budget families. No public exploit has been identified at time of analysis; MediaTek has issued patch ALPS11006447 via their July 2026 security bulletin, but exploitation requires a pre-existing System-level privilege on the device, making this a chaining vulnerability rather than a standalone entry vector.
Technical ContextAI
The affected component is the Android Telephony stack - the software layer managing baseband-to-application communications - as implemented on MediaTek chipsets. CWE-122 (Heap-Based Buffer Overflow) identifies the root cause: a write operation overruns the bounds of a heap-allocated buffer, corrupting adjacent memory. In telephony processing code, such corruption can overwrite heap metadata, vtable pointers, or function pointers, redirecting execution flow. The breadth of the CPE identifier (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) and the EUVD listing cover 22 specific chipsets - MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6853, MT6855, MT6877, MT6883, MT6885, MT6889, MT6893, MT8695, MT8696, MT8765, MT8766, MT8766R, MT8768, MT8781, and MT8791 - indicating the vulnerable Telephony code is shared across MediaTek's mid-range and budget SoC product lines, consistent with a common firmware codebase.
RemediationAI
The primary remediation is to apply the vendor-released patch identified as ALPS11006447 (Issue ID: MSV-7871), distributed through MediaTek's July 2026 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/July-2026. OEM device manufacturers must integrate this patch into their Android BSP and push OTA security updates to end users on affected devices; an exact patched firmware version is not independently specified in the available data beyond the patch ID. As a compensating control prior to patch deployment, defenders should enforce SELinux in enforcing mode (reducing the attack surface available to System-privilege processes), restrict sideloading and installation of applications with System-level permissions, and audit pre-installed applications for any that hold System privilege unnecessarily - since the attacker must satisfy the PR:H prerequisite before the Telephony overflow can be leveraged. These controls reduce the probability of an attacker reaching the exploit's prerequisite state but do not remediate the underlying heap overflow; patching remains mandatory.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today