EUVD-2026-52073
GHSA-gp8p-m3ww-5f47
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Local access required to invoke IPC; no calling-app permissions needed (PR:N) because the check is entirely absent on the service side; no availability impact described.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11087526; Issue ID: MSV-8243.
AnalysisAI
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of its declared Android permissions - to invoke protected telephony operations by exploiting a missing authorization check (CWE-862). The flaw affects 35 MediaTek chipsets spanning the Helio and Dimensity families and yields high confidentiality and integrity impact over telephony functions such as call management and SMS routing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker achieve local code execution on an affected MediaTek-chipset Android device - in practice, this means the target must install an attacker-controlled application, whether through sideloading, a compromised app store listing, or social engineering. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Multiple risk signals present a coherent but nuanced picture. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker distributes a malicious Android application that declares no sensitive telephony permissions in its manifest, bypassing Play Store or enterprise policy reviews that inspect declared permissions. Once installed on a device running an unpatched MediaTek chipset, the app silently calls protected Telephony IPC interfaces - leveraging the missing permission check - to read call history, intercept SMS metadata, or manipulate active calls without any user-visible indication. … |
| Remediation | The primary fix is patch ALPS11087526 (Issue MSV-8243), released by MediaTek in their August 2026 security bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all devices in your organization using affected MediaTek chipsets and assess exposure across enterprise-managed and BYOD Android populations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets
Local privilege escalation in MediaTek's geniezone hypervisor component affects 36 distinct chipsets spanning budget to
Same weakness CWE-862 – Missing Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today