EUVD-2026-52056
GHSA-4fw3-96wh-rv55
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Physical access required for pre-OS firmware exploitation; PR:N because software authentication is not active at secure boot stage; no availability impact as device hardware functionality is preserved.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: AUTO00845351 (Note: For MT2737) / ALPS11072643 (Note: For MT6880, MT6890, MT6990); Issue ID: MSV-6929.
AnalysisAI
Secure boot heap buffer overflow in MediaTek chipsets MT2737, MT6880, MT6890, and MT6990 enables local privilege escalation by an attacker with physical device access. The vulnerability exists at the pre-OS firmware layer, where a write beyond allocated heap boundaries can corrupt boot verification logic and permit execution of unsigned or attacker-controlled code. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, and the EPSS score of 0.16% (6th percentile) is consistent with the hard physical access prerequisite sharply limiting opportunistic exploitation.
Technical ContextAI
The vulnerable component is the secure boot (sec boot) subsystem embedded in MediaTek chipset firmware, confirmed via CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* across models MT2737, MT6880, MT6890, and MT6990. Secure boot is a firmware-level trust chain mechanism that cryptographically validates each bootloader stage before handing off execution; a flaw here operates entirely below the operating system. CWE-787 (Out-of-bounds Write) identifies the root cause as heap memory written beyond its allocated bounds, a class of vulnerability that can overwrite adjacent heap structures - in this context, potentially corrupting cryptographic verification state, function pointers, or boot policy flags used by the secure boot chain. Exploitation likely targets hardware debug or firmware-load interfaces (e.g., JTAG, USB fastboot, direct NAND flash) that are accessible prior to OS initialization.
RemediationAI
MediaTek has released patches identified as AUTO00845351 (specifically for MT2737) and ALPS11072643 (for MT6880, MT6890, and MT6990), documented in the August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. OEMs integrating affected chipsets must incorporate these patches into their firmware builds and distribute OTA updates to end users; there is no version number independently confirmed for the patched firmware release, only the internal patch IDs. As a compensating control where OEM patches are pending, organizations managing device fleets should enforce strict physical access controls - locking devices, enforcing tamper-evident seals, disabling accessible debug interfaces (JTAG, fastboot unlock) where the OEM allows it, and tracking device custody chains. Disabling USB debugging and bootloader unlock on managed devices limits the attack surface, though the trade-off is reduced repairability and development utility.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today