EUVD-2026-52065
GHSA-xrh8-cqf5-5p6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local code execution on affected device
-
DeliveryInvoke ccci driver interface with malformed request
-
ExploitTrigger missing bounds check in kernel driver
-
ExecutionOut-of-bounds memory access occurs
-
PersistKernel panic initiated
-
ImpactDevice crashes and reboots
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on the vulnerable device with standard user-level (PR:L) privileges - consistent with a normally installed Android application. No network access is required (AV:L); the attack vector is entirely local. No user interaction is needed beyond initial process execution (UI:N). The vulnerability must be present on a device running one of the three named MediaTek chipsets (MT6986, MT6988, or MT6813); devices using other MediaTek or non-MediaTek chipsets are not confirmed affected. Limiting factors include the strict local execution requirement, absence of scope change (S:U meaning no cross-process privilege escalation), and impact exclusively to availability - the attack produces a device crash but does not expose data or modify system state. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 5.5 Medium, reflecting a local attack with low privilege requirements, no user interaction, no scope change, and impact confined entirely to availability - no confidentiality or integrity loss. EPSS at 0.16% (6th percentile) indicates extremely low community-assessed exploitation probability, consistent with SSVC ratings of exploitation: none, automatable: no, and technical impact: partial. There is no CISA KEV listing and no publicly known proof-of-concept. All available signals converge: this is a real but low-urgency vulnerability whose practical risk is limited to device reboot/crash scenarios on specific MediaTek chipsets. The absence of privilege escalation or data exposure further constrains attacker motivation. Risk is most relevant for enterprise Android deployments where device uptime is operationally critical or for OEM patch compliance tracking. |
| Exploit ScenarioDerived | A malicious Android application running with standard user-level privileges on an affected MT6986, MT6988, or MT6813 device sends a crafted, malformed inter-processor communication request to the ccci kernel driver, triggering an out-of-bounds memory access that causes a kernel panic and forces an unplanned device reboot. The attack requires only that the application be installed and executed on the device - no network connectivity, elevated permissions, or user interaction beyond initial app launch is needed. No public proof-of-concept is known at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Local denial of service in MediaTek's ccci (Cross Core Communication Interface) kernel driver affects MT6986, MT6988, and MT6813 chipsets through a missing bounds check that enables an out-of-bounds memory access. A local user-privileged attacker - such as a malicious Android application - can crash the kernel, causing device unavailability without requiring user interaction. No public exploit code exists and EPSS probability is 0.16% (6th percentile); SSVC exploitation status is confirmed 'none,' aligning all risk signals toward low immediate threat.
RemediationAI
Apply the upstream fix identified as Patch ID ALPS10981532 (Issue ID MSV-7660), disclosed in the MediaTek August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Device OEMs integrating MT6986, MT6988, or MT6813 chipsets should incorporate this patch into their next Android Security Patch Level (ASPL) release. No specific patched firmware version or ASPL date was independently confirmed from available input data. As a compensating control for environments where patching is delayed, enforcing strict SELinux policies to restrict untrusted applications from accessing the ccci driver interface can limit exposure; however, this may impact modem communication functionality on affected devices and should be tested before deployment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The ccci component (Cross Core Communication Interface) is a kernel-mode driver present in MediaTek Android SoCs responsible for inter-processor communication between the application processor and the modem subsystem. A missing bounds check within this driver permits an out-of-bounds memory access when processing a malformed request from a user-space process. The NVD classifies the root cause as CWE-787 (Out-of-bounds Write), while the CVE description characterizes it as an out-of-bounds read - a discrepancy that is unresolved from available sources and should be verified against MediaTek's full advisory. The affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*, with EUVD data narrowing the scope to three specific chipsets: MT6986, MT6988, and MT6813. These are mid-range application processors commonly found in Android smartphones and tablets.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local user privilege is required to invoke ccci; impact is kernel crash only, with no confidentiality or integrity exposure and no scope change.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
DescriptionCVE.org
In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981532; Issue ID: MSV-7660.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek CCCI Out-of-Bounds Read Vulnerabilities
View all 2More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB