EUVD-2026-52072
GHSA-gm27-7f5g-4rrp
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent vector confirmed by description; no auth or interaction required; impact is availability-only with no scope change.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00486814; Issue ID: MSV-6824.
AnalysisAI
Denial of service in MediaTek WLAN STA (station mode) firmware causes affected devices to become fully unresponsive via uncontrolled logging resource exhaustion (CWE-770). An unauthenticated attacker within wireless proximity can trigger this condition with no user interaction required, targeting chipsets including MT7921, MT7922, MT7902, MT8532, and MT8518S - devices spanning consumer laptops, embedded systems, and IoT hardware. No public exploit or active exploitation has been identified; EPSS of 0.15% (5th percentile) indicates low probabilistic exploitation risk at this time.
Technical ContextAI
The vulnerability resides in MediaTek's WLAN station-mode (STA) firmware, the code responsible for managing Wi-Fi client connections on the affected chipsets. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: the firmware's logging subsystem fails to bound or throttle resource consumption when processing certain inputs, resulting in the system becoming fully unresponsive - a complete availability failure. The affected CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* spans a broad firmware release range, with specifically confirmed chipsets MT8532, MT7922, MT7921, MT7902, and MT8518S. MT7921 and MT7922 are widely deployed Wi-Fi 6/6E adapters integrated into consumer and enterprise laptops (Lenovo, ASUS, and others); MT8532 and MT8518S are used in IoT and embedded media platforms. The AV:A (adjacent network) vector confirms the attack is delivered over the wireless medium itself, limiting reach to physical proximity.
RemediationAI
Apply the MediaTek firmware fix identified by Patch ID WCNCR00486814, as detailed in the MediaTek August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Because MediaTek ships firmware to OEMs rather than directly to end users, affected device owners should check for firmware or driver updates from their device manufacturer (e.g., Lenovo, ASUS, or embedded system vendors using MT7921/MT7922/MT8532). No exact patched firmware version string is independently confirmed from available data - consult the OEM advisory for version specifics. Where patching is delayed, compensating controls include restricting device exposure to untrusted wireless networks (e.g., disabling Wi-Fi when not needed or enforcing use only on trusted, access-controlled SSIDs), deploying wireless intrusion prevention systems (WIPS) to detect anomalous frame patterns near sensitive devices, and prioritizing patch deployment for devices in high-risk locations such as public spaces, shared office Wi-Fi, or critical embedded deployments. Disabling the WLAN interface entirely eliminates the attack surface at the cost of wireless connectivity.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today