EUVD-2026-52065
GHSA-xrh8-cqf5-5p6c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local user privilege is required to invoke ccci; impact is kernel crash only, with no confidentiality or integrity exposure and no scope change.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981532; Issue ID: MSV-7660.
AnalysisAI
Local denial of service in MediaTek's ccci (Cross Core Communication Interface) kernel driver affects MT6986, MT6988, and MT6813 chipsets through a missing bounds check that enables an out-of-bounds memory access. A local user-privileged attacker - such as a malicious Android application - can crash the kernel, causing device unavailability without requiring user interaction. No public exploit code exists and EPSS probability is 0.16% (6th percentile); SSVC exploitation status is confirmed 'none,' aligning all risk signals toward low immediate threat.
Technical ContextAI
The ccci component (Cross Core Communication Interface) is a kernel-mode driver present in MediaTek Android SoCs responsible for inter-processor communication between the application processor and the modem subsystem. A missing bounds check within this driver permits an out-of-bounds memory access when processing a malformed request from a user-space process. The NVD classifies the root cause as CWE-787 (Out-of-bounds Write), while the CVE description characterizes it as an out-of-bounds read - a discrepancy that is unresolved from available sources and should be verified against MediaTek's full advisory. The affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*, with EUVD data narrowing the scope to three specific chipsets: MT6986, MT6988, and MT6813. These are mid-range application processors commonly found in Android smartphones and tablets.
RemediationAI
Apply the upstream fix identified as Patch ID ALPS10981532 (Issue ID MSV-7660), disclosed in the MediaTek August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Device OEMs integrating MT6986, MT6988, or MT6813 chipsets should incorporate this patch into their next Android Security Patch Level (ASPL) release. No specific patched firmware version or ASPL date was independently confirmed from available input data. As a compensating control for environments where patching is delayed, enforcing strict SELinux policies to restrict untrusted applications from accessing the ccci driver interface can limit exposure; however, this may impact modem communication functionality on affected devices and should be tested before deployment.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today