EUVD-2026-52054
GHSA-mg45-crjv-3qfx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
AC:H reflects compound attack requirement; S:C and A:H reflect privilege boundary crossing beyond System into kernel, diverging from vendor's S:U/A:N.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11104718; Issue ID: MSV-8297.
AnalysisAI
Out-of-bounds write in the MediaTek HEVC video decoder enables further privilege escalation on devices running MT6761, MT8766, and MT8768 chipsets. The flaw, rooted in an integer overflow during HEVC bitstream processing, can be triggered without user interaction but only by an actor who already holds System-level privilege on the device. No public exploit code has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with SSVC's 'Exploitation: none' assessment - though SSVC rates Technical Impact as total, reflecting the severity of what a successful second-stage exploit could achieve.
Technical ContextAI
The vulnerability resides in MediaTek's HEVC (H.265) hardware or firmware decoder component, which is responsible for parsing and decoding High Efficiency Video Coding bitstreams. MediaTek chipsets MT6761, MT8766, and MT8768 are confirmed affected per EUVD-2026-52054. The root cause is CWE-787 (Out-of-Bounds Write) triggered by an integer overflow: during HEVC bitstream parsing, an arithmetic operation overflows its integer type, producing an undersized buffer allocation or an incorrect index, which is then used in a write operation that exceeds buffer boundaries. In Android-based deployments using these chipsets, the media decoder typically runs in a privileged process context. Exploiting this OOB write from a System-privilege vantage point could corrupt adjacent memory structures - kernel data, function pointers, or security-sensitive state - facilitating a privilege boundary crossing beyond System level. Patch ID ALPS11104718 and Issue ID MSV-8397 were assigned internally by MediaTek.
RemediationAI
The primary fix is the vendor-released patch identified internally as ALPS11104718 - device manufacturers (OEMs) must integrate this patch into their firmware builds and distribute it to end users via OTA updates. Security teams should verify whether their device fleet's OEM has published an updated firmware incorporating this patch by consulting the MediaTek August 2026 security bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. An exact patched firmware version number was not independently confirmed in the available data; contact your device OEM directly for firmware release details. As a compensating control, limiting or removing applications with System-level privileges that can process arbitrary HEVC content (e.g., restricting third-party media applications with elevated permissions) reduces the attack surface, though this may impact media functionality. Enforcing SELinux in enforcing mode on Android devices can constrain what a successful OOB write can achieve, limiting blast radius. Given the System privilege prerequisite, prioritizing remediation of any other System-privilege escalation vulnerabilities in the environment will also reduce exposure to this flaw.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today