EUVD-2026-52066
GHSA-9jxv-qr96-p4v6
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Local display driver access requiring pre-obtained System privilege justifies AV:L and PR:H; OOB write enables memory corruption with high C and I impact, but A:N per vendor assessment.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11009963; Issue ID: MSV-7658.
AnalysisAI
Out-of-bounds write in the MediaTek display driver allows a local attacker who has already obtained System-level privilege to further escalate privileges on affected Android devices. The vulnerability stems from a missing bounds check (CWE-787) in display subsystem code across at least ten MediaTek chipsets, including MT8910, MT8188, MT8799, and MT6991 among others. No public exploit or active exploitation (CISA KEV) is identified at time of analysis; EPSS score of 0.14% (4th percentile) and SSVC exploitation rating of 'none' both confirm this remains an undemonstrated threat as of the August 2026 advisory.
Technical ContextAI
The vulnerability resides in the MediaTek display driver - a kernel-space component responsible for managing framebuffer operations and display pipeline interactions on MediaTek SoCs. CWE-787 (Out-of-Bounds Write) indicates the driver writes past the end of an allocated memory buffer due to a missing bounds check, a class of flaw that classically enables memory corruption, control-flow hijacking, and privilege escalation within the kernel. The CPE string cpe:2.3:a:mediatek,_inc.:mediatek_chipset identifies MediaTek's proprietary SoC platform as the affected software layer, running on ARM-based chipsets commonly found in Android mobile and embedded devices. Display drivers interface closely with kernel memory and hardware registers, making OOB write primitives in this subsystem particularly powerful for privilege escalation chains. The patch is tracked internally as ALPS11009963 and MSV-7658, typical of MediaTek's internal patch management system.
RemediationAI
The primary remediation is applying the vendor-released patch referenced as ALPS11009963 in MediaTek's August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Device manufacturers (OEMs) integrating these chipsets must incorporate this patch into their Android security update releases; end users should apply OEM firmware updates as soon as they become available for their specific device models. Because exploitation requires System-level privilege, a compensating control for organizations managing fleets of Android devices is to enforce strict access control policies that prevent unauthorized applications from obtaining System privilege - this can be achieved through enterprise MDM policies, disabling developer options, and enforcing verified boot. Restricting sideloading and app installation from untrusted sources reduces the risk of a malicious application obtaining System privilege in the first place, thereby breaking the exploit chain upstream of this vulnerability. No workaround exists for the display driver flaw itself without the vendor patch.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today