EUVD-2026-52063
GHSA-mx2w-3qf4-9ffq
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Race condition exploitation inherently requires timing precision, warranting AC:H over the vendor's AC:L; PR:H and AV:L confirmed by System privilege prerequisite and local-only access.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019183; Issue ID: MSV-7758.
AnalysisAI
Local privilege escalation in the MediaTek display subsystem affects 17 distinct chipsets including MT6991, MT8768, MT8678, and MT8799, among others. An attacker who has already obtained System-level privilege can exploit a race condition (CWE-367) in the display driver to achieve further privilege escalation, resulting in high confidentiality and integrity impact on the device. No public exploit has been identified at time of analysis, and the EPSS score of 0.11% (2nd percentile) reflects minimal observed exploitation probability; MediaTek has released patch ALPS11019183 via its August 2026 Product Security Bulletin.
Technical ContextAI
The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use - TOCTOU), a class of race condition where a resource's state is verified at one point in time but acted upon later, allowing an attacker to modify the resource in the intervening window. In this case, the flaw resides in the display driver component of the MediaTek SoC stack, which operates at a privileged kernel level. The affected CPE (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) spans a broad range of MediaTek mobile and embedded chipsets - including MT6991, MT8768, MT8678, MT8799, MT8189, MT8781, MT6993, MT8367, MT8791T, MT8766, MT8188, MT8910, MT8676, MT8786, MT8126, MT8171, and MT8668 - commonly found in Android smartphones and tablets from numerous OEM/ODM manufacturers. The CVSS vector (AV:L/AC:L/PR:H) indicates the flaw is reachable only from a local execution context by a process already operating at System privilege, consistent with a kernel display driver accessible to high-privilege Android system processes.
RemediationAI
Apply MediaTek patch ALPS11019183, disclosed in the August 2026 MediaTek Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. OEM and ODM device manufacturers using affected chipsets (MT6991, MT8768, MT8678, MT8799, MT8189, MT8781, MT6993, MT8367, MT8791T, MT8766, MT8188, MT8910, MT8676, MT8786, MT8126, MT8171, MT8668) must integrate this patch into their Android security update cycles and push updates to end-user devices. No exact patched firmware or software version number is independently confirmed beyond the patch ID. As a compensating control where patching is delayed, restricting the attack surface by enforcing strict SELinux policies to limit which processes can reach display driver interfaces reduces exposure - however, since PR:H is already required, the realistic compensating control benefit is marginal. No workaround is documented by the vendor.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today