EUVD-2026-52061
GHSA-3xg4-36gp-wp4m
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Local-only access, System privilege required as precondition, no confidentiality or integrity impact, only availability loss via crash.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In TFA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10991467; Issue ID: MSV-7764.
AnalysisAI
Out-of-bounds write in MediaTek's Trusted Firmware-A (TFA) component allows a local attacker already holding System-level privilege to crash the device, causing a denial of service. Affected hardware includes MediaTek Dimensity and Helio chipsets MT6986D, MT6986, and MT6982VB. No public exploit code has been identified and CISA KEV does not list this vulnerability, consistent with its low EPSS score of 0.14% and SSVC exploitation status of none.
Technical ContextAI
TFA refers to Arm Trusted Firmware-A, the reference implementation of secure-world firmware that runs at EL3 (Exception Level 3) on Arm-based SoCs. MediaTek integrates a customized TFA build into its chipsets. CWE-787 (Out-of-Bounds Write) indicates a memory safety flaw where write operations are performed beyond the bounds of an allocated buffer due to a missing bounds check, potentially corrupting adjacent memory structures. The affected CPE (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) and EUVD-confirmed affected versions cover MT6986D, MT6986 (Dimensity 9200 family), and MT6982VB (Helio G99 family) - mid-to-flagship tier mobile SoCs widely deployed in Android smartphones. Patch IDs ALPS10991467 and MSV-7764 reference MediaTek's internal tracking for this firmware defect.
RemediationAI
OEMs and device manufacturers integrating the affected MediaTek chipsets should apply the firmware patch identified by Patch ID ALPS10991467, available through MediaTek's standard chipset firmware update channel as documented in the August 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/August-2026). End users should apply Android OTA updates from their device manufacturer once the patched firmware is integrated into a device software release. No exact patched firmware version number is independently confirmed in available data beyond the patch ID. Because exploitation requires pre-existing System privilege, organizations should also prioritize hardening against initial privilege escalation paths on affected devices as a compensating control - removing the prerequisite privilege access eliminates the attack surface for this vulnerability without firmware changes.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today