EUVD-2026-52076
GHSA-8rj7-4f5c-p94f
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Local vector, high privilege prerequisite (System UID required), no user interaction; confidentiality and integrity fully compromised at higher privilege tier, no availability impact described.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11049569; Issue ID: MSV-7931.
AnalysisAI
Out-of-bounds write in MediaTek's HFRP component on the MT6993 chipset enables local privilege escalation beyond System-level access, confirmed via MediaTek's August 2026 security bulletin. The flaw stems from a missing bounds check (CWE-787), requiring an attacker who has already achieved System privilege to trigger further escalation - a post-compromise lateral movement primitive rather than an initial access vector. No public exploit code and no KEV listing have been identified; EPSS sits at the 3rd percentile, consistent with SSVC's 'exploitation: none' finding.
Technical ContextAI
HFRP is a MediaTek-proprietary firmware or driver component running on the MT6993 system-on-chip. CWE-787 (Out-of-Bounds Write) indicates the component fails to validate buffer boundaries before writing attacker-controlled data, allowing memory corruption beyond an allocated buffer. On Android-based SoCs, components running at or near the kernel/trusted execution boundary that lack bounds checks can be exploited to overwrite adjacent memory structures - function pointers, security descriptors, or credentials - enabling elevation from Android's 'system' UID to root or kernel context. The CPE string cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* applies broadly to the chipset family, but EUVD data narrows the affected hardware to the MT6993 specifically.
RemediationAI
MediaTek has released a fix identified by Patch ID ALPS11049569, documented in the August 2026 security bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Device OEMs (smartphone manufacturers) must integrate this patch into their Android firmware builds and distribute it to end users via OTA updates; end users should apply all available system updates for their MT6993-based devices. No specific workaround exists for the underlying bounds-check flaw, but the high privilege prerequisite (System-level access) means the primary compensating control is hardening against the initial privilege escalation that would first grant an attacker System access - reducing the attack surface of components reachable by untrusted applications.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today