EUVD-2026-52060
GHSA-w9g5-vfpg-gh63
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Physical access required to reach DA mode (AV:P); only availability impact as OOB write causes device crash with no code execution or data exposure.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10991588 (Note: For MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) / AUTO00851171 (Note: For MT2735, MT2737); Issue ID: MSV-7790.
AnalysisAI
Out-of-bounds write in the MediaTek Download Agent (DA) firmware component across eight chipset families allows an attacker with physical device access to trigger a local denial of service by sending a crafted payload while the device is in DA mode. Affected chipsets span mobile SoCs (MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) and modem/automotive chipsets (MT2735, MT2737), broadening the potential device footprint across Android smartphones and connected vehicle platforms. No public exploit code exists, EPSS sits at the 6th percentile (0.16%), SSVC confirms no known exploitation, and the physical access prerequisite fundamentally constrains real-world risk.
Technical ContextAI
The DA (Download Agent) is a low-level MediaTek firmware subsystem used for device flashing and diagnostics, accessed via USB in a special pre-boot mode. CWE-787 (Out-of-bounds Write) identifies the root cause: a missing bounds check allows write operations to exceed an allocated memory buffer, corrupting memory and causing a denial-of-service condition. The affected products per CPE (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) include MT6880, MT6890, MT6990, MT6988, MT6986, and MT6813 - mobile application processor SoCs - as well as MT2735 and MT2737, which serve modem and automotive use cases. The DA subsystem is distinct from the main OS runtime; this vulnerability is exploitable only when the device is placed into DA boot mode, not during normal operation.
RemediationAI
Device manufacturers (OEMs) should integrate MediaTek patch ALPS10991588 for products using MT6880, MT6890, MT6990, MT6988, MT6986, or MT6813 chipsets, and patch AUTO00851171 for products using MT2735 or MT2737, then distribute updated firmware to end users via OTA or carrier updates. Consult the MediaTek August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026 for integration guidance. As a compensating control for enterprise or fleet-managed devices pending patch deployment, enforce physical security policies: restrict unattended device access, apply tamper-evident seals to high-value assets, and where OEM tooling permits, disable or lock Download Agent mode in production device configurations to prevent unauthorized entry into DA boot mode. Disabling DA mode may affect legitimate repair workflows, so weigh operational impact against the low exploitation probability before applying.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today