EUVD-2026-52059
GHSA-97c8-m5xh-6cgp
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Changed UI:N to UI:R to match description's explicit statement; all other metrics align with local, high-privilege, write-what-where exploitation with no availability impact.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In trusted_mem, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: AUTO00834868; Issue ID: MSV-6533.
AnalysisAI
Privilege escalation in MediaTek's trusted_mem subsystem affects nine specific chipset models (MT8365, MT8186, MT8188, MT8195, MT8370, MT8371, MT8390, MT8391, MT8395) through a write-what-where condition caused by improper input validation. An attacker who has already obtained System-level privilege can leverage this flaw to escalate further, potentially compromising the trusted memory environment. No public exploit code has been identified and EPSS places exploitation probability at 0.14% (4th percentile), indicating this is currently a low-exploitation-pressure issue despite its local privilege escalation potential.
Technical ContextAI
The vulnerability resides in trusted_mem, MediaTek's trusted memory management subsystem responsible for isolating secure memory regions on its application processor chipsets. CWE-123 (Write-what-where Condition) indicates that improper input validation allows an attacker to control both the value and destination address of a memory write operation - a powerful exploit primitive that can corrupt security-critical data structures or code pointers within the trusted environment. The affected CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:* covers a broad family of Arm-based SoCs used in Android tablets and embedded platforms. The trusted_mem layer typically interfaces with TrustZone or similar TEE constructs, meaning a write-what-where exploit here could potentially bridge the boundary between the rich OS and secure world, making it a high-value target despite the steep prerequisite bar.
RemediationAI
Apply the MediaTek-supplied patch identified as AUTO00834868 (Issue MSV-6533), distributed through MediaTek's August 2026 security bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Device OEMs and ODMs integrating affected chipsets (MT8365, MT8186, MT8188, MT8195, MT8370, MT8371, MT8390, MT8391, MT8395) should request the patch from MediaTek and incorporate it into their next firmware or Android security patch release. End users should apply OEM firmware updates as they become available. No exact patched firmware version number is independently confirmable from the available references - organizations should confirm the patched build version directly with their device OEM. As a compensating control where patching is delayed, restrict the set of applications and processes permitted to run with System privilege, and apply SELinux or equivalent mandatory access control policies to limit trusted_mem access to only authorized system processes.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-123 – Write-what-where Condition
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today