EUVD-2026-52064
GHSA-7779-c4hg-x9wj
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Local vector and PR:H reflect required pre-existing System privilege; C:H/I:H capture memory corruption impact; A:N as no availability disruption is described.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7748.
AnalysisAI
Local privilege escalation in MediaTek's display subsystem affects 17 chipset variants used in Android devices, allowing an attacker who has already obtained System-level privilege to exploit a missing bounds check (CWE-787) and write out of bounds in display memory, achieving high confidentiality and integrity impact. The CVSS vector (PR:H/AV:L) confirms this is not an initial-access vector - it is a post-compromise escalation step requiring pre-existing System privilege. No public exploit has been identified, EPSS stands at 0.14% (4th percentile), and the vulnerability is not listed in CISA KEV, consistent with SSVC's exploitation status of 'none.'
Technical ContextAI
The flaw resides in MediaTek's display driver/subsystem (tagged as display in the bulletin), where a missing bounds check allows an out-of-bounds write - classified as CWE-787. The root cause is a failure to validate buffer boundaries before writing, a common source of memory corruption in low-level hardware drivers. Affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*, covering a broad generation of MediaTek SoCs. These chipsets are embedded in Android-based consumer and commercial devices; the display subsystem runs with elevated kernel or privileged context, making any memory corruption there a candidate for privilege escalation. Patch ID ALPS11004276 and Issue ID MSV-7748 are the internal MediaTek tracking identifiers.
RemediationAI
Apply MediaTek patch ALPS11004276, distributed through the August 2026 MediaTek Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. OEM and ODM partners integrating affected chipsets must incorporate this patch into their device firmware and push updates through their own over-the-air (OTA) update channels. An exact patched firmware version is not independently confirmed from available data - consult the MediaTek bulletin directly for version specifics. As a compensating control where patching is delayed, restricting access to System-level processes through SELinux policy tightening or reducing attack surface via disabling unnecessary display-related privileged services can raise the bar for exploitation, though these do not address the root cause and carry risk of breaking legitimate functionality.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today