EUVD-2026-52067
GHSA-36p8-6qw9-45qf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local-only HAL access model mandates AV:L; standard user process sufficient so PR:L; DoS-only impact means C:N/I:N with A:H; no scope change applies.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981454 (Note: For MT6880, MT6890, MT6988, MT6990) / AUTO00851293 (Note: For MT2735, MT2737); Issue ID: MSV-7638.
AnalysisAI
Heap buffer overflow in MediaTek's Audio Hardware Abstraction Layer (HAL) across six chipset families enables local denial of service on affected mobile and automotive platforms. A local user-level process can trigger an out-of-bounds write in the Audio HAL, crashing the audio subsystem with no user interaction required. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with SSVC's 'none' exploitation status and the strictly local, availability-only impact profile.
Technical ContextAI
The vulnerable component is MediaTek's Audio Hardware Abstraction Layer - the Android software bridge between the audio framework (AudioFlinger) and chipset-level hardware drivers. CWE-787 (Out-of-bounds Write) indicates the HAL fails to enforce heap buffer boundaries during audio data processing, allowing writes beyond allocated memory regions. The affected chipsets span two distinct patch groups: MT6880, MT6890, MT6988, and MT6990 (mobile SoC family, patch ALPS10981454) and MT2735 and MT2737 (automotive-grade, patch AUTO00851293), as confirmed by MediaTek's August 2026 bulletin. The CPE string cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* covers the full affected product family. The heap corruption is write-only with no demonstrated read primitive, which constrains the impact to availability degradation rather than code execution or data leakage.
RemediationAI
Apply the vendor-confirmed patches: ALPS10981454 for MT6880, MT6890, MT6988, and MT6990 chipsets, and AUTO00851293 for MT2735 and MT2737, as detailed in the MediaTek August 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/August-2026). OEM device manufacturers integrating these chipsets should incorporate the patches into their next Android security update release cycle and push over-the-air updates to end users. Where patching is delayed, restricting untrusted application access to audio system services via tightened SELinux policy or by disabling audio processing APIs for third-party apps can reduce exposure - note this trade-off will affect legitimate audio application functionality. Exact patched firmware or BSP versions for OEM integration are not independently specified in available data beyond the MediaTek patch IDs.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today