EUVD-2026-52062
GHSA-23j5-3m4p-44jj
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Local display driver UAF requires existing System privilege (AV:L, PR:H); memory corruption yields kernel read/write primitives (C:H/I:H) with no stated availability impact (A:N).
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019722; Issue ID: MSV-7759.
AnalysisAI
Local privilege escalation in the MediaTek display driver allows an attacker who already holds System-level privileges to further escalate via a use-after-free memory corruption condition, potentially achieving kernel-level access. Seventeen MediaTek SoC models used across Android devices are affected, disclosed in MediaTek's August 2026 security bulletin with Patch ID ALPS11019722. No public exploit code exists and EPSS at 0.14% (4th percentile) confirms negligible current exploitation probability; this vulnerability is not in the CISA KEV catalog.
Technical ContextAI
The vulnerability (CWE-416, Use After Free) resides in the display driver component of affected MediaTek SoCs. Use-after-free flaws occur when a memory object is deallocated but a dangling pointer to that region is subsequently accessed or manipulated - in display subsystems, this commonly arises during frame buffer lifecycle management, display context teardown, or concurrent resource access. The CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset covers the 17 confirmed affected chipsets: MT6991, MT6993, MT8126, MT8171, MT8188, MT8189, MT8367, MT8668, MT8676, MT8678, MT8766, MT8768, MT8781, MT8786, MT8791T, MT8799, and MT8910. These SoCs span MediaTek's Dimensity and Helio product lines, deployed across Android smartphones, tablets, and Chromebooks from numerous OEMs. The tags also reference Denial of Service and Buffer Overflow, but the authoritative root cause per the CVE record is CWE-416; secondary effects may include memory corruption patterns consistent with buffer overflow-class impacts.
RemediationAI
Apply the patch identified as ALPS11019722 (Issue ID: MSV-7759), disclosed in MediaTek's August 2026 security bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Because MediaTek supplies chipsets to OEM device manufacturers, end users must await firmware and Android security updates pushed by their respective device vendors; there is no mechanism for end users to apply MediaTek patches directly. An exact patched firmware version number was not independently confirmed from the available data - only the patch ID is disclosed. As a compensating control pending OEM patch deployment, organizations managing Android device fleets should enforce policies that prevent applications from acquiring System-level privileges (e.g., restricting adb access, enforcing SELinux enforcing mode, and disabling developer options on managed devices). These measures reduce the attacker's ability to reach the PR:H precondition required for exploitation, but do not address the underlying vulnerability.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-416 – Use After Free
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today