EUVD-2026-52067
GHSA-36p8-6qw9-45qf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local user-level process on device
-
DeliveryInteract with Audio HAL interface
-
ExploitSubmit malformed audio buffer data
-
ExecutionTrigger out-of-bounds heap write in HAL
-
ImpactCrash audio subsystem (local DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on a physical or virtual device equipped with one of the six affected MediaTek chipsets (MT6880, MT6890, MT6988, MT6990, MT2735, or MT2737). The CVSS PR:L metric confirms that at minimum a standard user-level process - not root or administrator access - is required; unauthenticated or network-based exploitation is categorically excluded by the AV:L (local) attack vector. No special configuration of the Audio HAL is required beyond its default active state on affected platforms. Exploitation is bounded entirely to availability impact (DoS) - no confidentiality or integrity compromise is achievable via this vector. The attack is not automatable per SSVC, meaning mass or scripted targeting is not feasible. |
| Impact | CVSS 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes this as a low-complexity, locally-triggered denial-of-service with no scope change and no confidentiality or integrity impact. EPSS at 0.15% (5th percentile) is very low, reflecting the negligible probability of observed exploitation. SSVC reinforces this: exploitation is 'none,' the attack is 'not automatable,' and technical impact is 'partial.' There is no CISA KEV listing and no public proof-of-concept identified. This is a genuine moderate-severity issue confined to devices carrying specific MediaTek chipsets - meaningful for device OEMs who must integrate the patch, but not an emergency priority for most enterprise or consumer defenders. The real-world risk is low: an attacker must already have local code execution on a targeted device, and the maximum gain is crashing audio services. |
| Exploit ScenarioDerived | A malicious or compromised application with standard user privileges on a device running an affected MediaTek chipset submits specially crafted audio buffers to the Audio HAL interface, triggering a heap out-of-bounds write in the audio processing path. The resulting memory corruption crashes the audio subsystem, causing loss of audio functionality or, depending on crash recovery behavior, a broader system restart. No public proof-of-concept has been identified, making opportunistic exploitation unlikely at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Heap buffer overflow in MediaTek's Audio Hardware Abstraction Layer (HAL) across six chipset families enables local denial of service on affected mobile and automotive platforms. A local user-level process can trigger an out-of-bounds write in the Audio HAL, crashing the audio subsystem with no user interaction required. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with SSVC's 'none' exploitation status and the strictly local, availability-only impact profile.
RemediationAI
Apply the vendor-confirmed patches: ALPS10981454 for MT6880, MT6890, MT6988, and MT6990 chipsets, and AUTO00851293 for MT2735 and MT2737, as detailed in the MediaTek August 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/August-2026). OEM device manufacturers integrating these chipsets should incorporate the patches into their next Android security update release cycle and push over-the-air updates to end users. Where patching is delayed, restricting untrusted application access to audio system services via tightened SELinux policy or by disabling audio processing APIs for third-party apps can reduce exposure - note this trade-off will affect legitimate audio application functionality. Exact patched firmware or BSP versions for OEM integration are not independently specified in available data beyond the MediaTek patch IDs.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is MediaTek's Audio Hardware Abstraction Layer - the Android software bridge between the audio framework (AudioFlinger) and chipset-level hardware drivers. CWE-787 (Out-of-bounds Write) indicates the HAL fails to enforce heap buffer boundaries during audio data processing, allowing writes beyond allocated memory regions. The affected chipsets span two distinct patch groups: MT6880, MT6890, MT6988, and MT6990 (mobile SoC family, patch ALPS10981454) and MT2735 and MT2737 (automotive-grade, patch AUTO00851293), as confirmed by MediaTek's August 2026 bulletin. The CPE string cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* covers the full affected product family. The heap corruption is write-only with no demonstrated read primitive, which constrains the impact to availability degradation rather than code execution or data leakage.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local-only HAL access model mandates AV:L; standard user process sufficient so PR:L; DoS-only impact means C:N/I:N with A:H; no scope change applies.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
DescriptionCVE.org
In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981454 (Note: For MT6880, MT6890, MT6988, MT6990) / AUTO00851293 (Note: For MT2735, MT2737); Issue ID: MSV-7638.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek Audio HAL Buffer Overflow and Race Condition
View all 3More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB