EUVD-2026-52069
GHSA-9v43-w5wr-hc42
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local attack vector and low privileges confirmed by HAL-layer access requirement; impact is availability-only with no confidentiality or integrity exposure.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960023 (Note: For MT6880, MT6890, MT6980D, MT6988, MT6990) / AUTO00851189 (Note: For MT2735, MT3737); Issue ID: MSV-7586.
AnalysisAI
Heap buffer overflow in the MediaTek Audio HAL enables a local attacker with user-level privileges to crash the audio subsystem, resulting in a denial of service condition on affected devices. Seven MediaTek chipsets across mobile and automotive platforms are affected, with MediaTek releasing two separate patch IDs addressing the flaw in its August 2026 security bulletin. EPSS at 0.15% (5th percentile), no KEV listing, and a CISA SSVC exploitation status of 'none' collectively indicate negligible real-world exploitation risk at time of analysis; no public exploit code has been identified.
Technical ContextAI
The Audio HAL (Hardware Abstraction Layer) is a system-level Android component that abstracts audio hardware from higher-level software frameworks, running with elevated system context relative to standard user applications. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: a write operation in the HAL's audio processing path overruns the bounds of a heap-allocated buffer, potentially corrupting adjacent heap memory. The affected CPE (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) covers MediaTek's SoC product line broadly; specific affected models span mobile-grade chipsets (MT6880, MT6890, MT6980D, MT6988, MT6990) and connectivity or automotive chipsets (MT2735, MT3737). Because the HAL sits between hardware drivers and the Android audio framework, a crash in this component terminates audio services without necessarily compromising kernel integrity, explaining the availability-only impact.
RemediationAI
MediaTek has released patches via two patch IDs: ALPS10960023 for chipsets MT6880, MT6890, MT6980D, MT6988, and MT6990, and AUTO00851189 for MT2735 and MT3737. Device OEMs and BSP integrators should obtain and integrate these patches from MediaTek and distribute updated firmware through their standard over-the-air or service update channels. Full details are available in the MediaTek Product Security Bulletin for August 2026 at https://www.mediatek.com/product-security-bulletin/August-2026. No exact patched firmware or BSP version numbers are independently confirmed beyond the patch IDs provided by MediaTek. As a compensating control pending patch deployment, restricting sideloaded or untrusted application installation on affected devices reduces the pool of local code execution vectors, though this may limit device functionality. Given the DoS-only impact, this vulnerability should be prioritized behind RCE-class or credential-exposure class issues in patch scheduling.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today