EUVD-2026-52075
GHSA-mhh4-4rgh-x32m
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Local-only attack surface, System privilege required to invoke TFA interface, confidentiality-only impact with no integrity or availability consequence.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11053160; Issue ID: MSV-8004.
AnalysisAI
Information disclosure in the TFA (Trusted Firmware-A) component of MediaTek chipsets allows a local attacker who has already obtained System-level privilege to retrieve sensitive secure-world data without user interaction, due to a missing permission check (CWE-201). The flaw spans 39 distinct MediaTek chipsets across the MT6xxx and MT8xxx families, covering a broad range of Android smartphones, tablets, and embedded devices. No public exploit code or active exploitation has been identified; EPSS stands at 0.14% (4th percentile), consistent with the high privilege prerequisite limiting real-world impact.
Technical ContextAI
TFA (Trusted Firmware-A) is ARM's reference secure-world firmware, integrated by MediaTek into its SoC families to manage TrustZone operations, cryptographic key handling, and trusted execution environment (TEE) lifecycle on ARM-based processors. The root cause is CWE-201 - a missing permission check that fails to validate whether the calling context is authorized before returning sensitive information from the secure firmware layer. This means a caller at System privilege can invoke a TFA interface that should be restricted to higher-privilege or secure-world-only contexts. CPE data (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) confirms broad scope across both the MT6xxx mobile application processor family and MT8xxx tablet, automotive, and connectivity SoC family. The issue is tracked internally by MediaTek as Patch ID ALPS11053160 and Issue ID MSV-8004.
RemediationAI
Apply the patch identified as ALPS11053160 distributed by MediaTek through the August 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/August-2026). Because MediaTek delivers firmware fixes to OEM and ODM partners who then incorporate them into device-specific security updates, end users should apply the next available firmware or Android security patch level update from their device manufacturer as soon as it is released. Where immediate patching is not feasible, compensating controls should focus on reducing the likelihood that an attacker achieves the required System-level privilege: enforcing SELinux in Enforcing mode prevents many privilege escalation paths; disabling ADB root and developer options on production devices removes a common route to System; and restricting privileged application installation via MDM policy limits the attack surface. These controls do not remediate the underlying missing permission check but materially raise the bar for reaching the prerequisite privilege level. Note that OEM-specific patched firmware version identifiers are not independently published in available references - verify with your device manufacturer.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today