EUVD-2026-52074
GHSA-673r-7q9g-8844
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Local vector required since exploitation demands on-device app execution; PR:N confirmed because the exported component imposes no privilege check on callers; C:H reflects telephony subscriber data sensitivity; no integrity or availability impact.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11086431; Issue ID: MSV-8189.
AnalysisAI
Local information disclosure in the Telephony component across 42 MediaTek chipsets enables any unprivileged application on the device to extract sensitive telephony data without elevated permissions. The root cause is a missing Android permission check (CWE-926: Improper Export of Android Application Components), allowing improperly exported Telephony interfaces to be queried by any installed app. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an attacker have local code execution on the device, specifically a malicious or compromised application installed on the target Android device running an affected MediaTek chipset (any of the 42 SKUs listed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 6.2, which is consistent with the attack profile: local vector limits exposure relative to network-accessible flaws, but the absence of any privilege requirement (PR:N) and lack of user interaction (UI:N) means any installed application - including those with only INTERNET permission - can potentially invoke the exposed component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply patch ALPS11086431 as documented in MediaTek's August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today