EUVD-2026-40876
GHSA-hq5v-pc42-8w5f
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only vector (AV:L) with high privilege prerequisite (PR:H) matches the System-level access requirement; full C/I/A impact reflects post-escalation control.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01716533; Issue ID: MSV-6309.
AnalysisAI
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System-level access to bypass permission enforcement (CWE-280) and escalate further within the device. The vulnerability is confirmed by MediaTek in their July 2026 Product Security Bulletin (Patch ID: MOLY01716533, Issue ID: MSV-6309) and affects a broad swath of chipsets spanning low-end to flagship tiers. No user interaction is required for exploitation, but the prerequisite of System-level access significantly constrains the realistic attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The affected component is the MediaTek Modem software stack, which runs on dedicated baseband/modem processor firmware present in MediaTek SoCs. The root cause is classified as CWE-280 (Improper Handling of Insufficient Permissions or Privileges), meaning the Modem component fails to correctly validate or enforce permission boundaries when requests arrive from a caller already operating at System privilege - allowing that caller to obtain capabilities beyond what should be granted. This is distinct from a memory corruption or injection flaw; the logic flaw lies in permission-check handling. The CPE string (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) confirms this spans the entire MediaTek chipset product family. Affected chipsets include modems targeting both Android handsets (MT6761, MT6769, MT6785, MT6893, MT6989, MT6993, etc.) and IoT/tablet segments (MT8765, MT8788, MT8893, etc.).
RemediationAI
MediaTek has released a patch identified as Patch ID MOLY01716533, disclosed in the July 2026 MediaTek Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/July-2026. Device manufacturers (OEMs) must integrate this modem firmware patch into their Android security updates before it reaches end-user devices; the fix does not ship directly from MediaTek to consumers. Affected device owners should apply Android security updates from their OEM as soon as they are made available. Because an exact patched modem firmware version number was not independently confirmed in publicly accessible sources, administrators should verify with the relevant device vendor that the July 2026 MediaTek patch level is incorporated. As a compensating control prior to patch availability, restricting the ability of third-party or sideloaded applications from reaching System privilege (via strict SELinux enforcement, disabling ADB root access, and ensuring bootloader integrity) reduces the likelihood that an attacker can satisfy the prerequisite System-level access required for exploitation.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today