EUVD-2026-52078
GHSA-85vg-gq3h-4v5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain System privilege on target device
-
DeliveryAccess display driver interface
-
ExploitTrigger missing bounds check via crafted syscall
-
ExecutionRead out-of-bounds kernel memory
-
ImpactExfiltrate sensitive memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess System-level privileges on a device running one of the 17 affected MediaTek chipsets - this is a post-exploitation primitive, not an initial access vector. The display subsystem must be accessible from the System privilege context (standard on Android). No user interaction is required once System privilege is held. Limiting factors are substantial: the PR:H requirement means a full prior compromise is a prerequisite, local access (AV:L) rules out remote attack, and the impact is read-only confidentiality disclosure with no integrity or availability consequences. |
| Impact | Despite a CVSS confidentiality impact of High (C:H), the overall CVSS base score of 4.4 accurately reflects that exploitation requires System-level privilege (PR:H) and local access (AV:L), dramatically constraining the realistic attack surface. An actor who already holds System privilege on Android has already cleared significant security hurdles; the marginal risk of this additional read primitive is moderate at best. EPSS at 0.14% (4th percentile) corroborates this low exploitation likelihood, and SSVC further classifies technical impact as only 'partial', reinforcing that the disclosed memory may not contain universally sensitive data. No KEV listing and no reported POC mean there is no confirmed weaponization. The CVSS vector is internally consistent with the description - local System-privilege-required read-only flaw - with no contradictions between the vector and the described attack conditions. Priority should be low for most organizations unless the threat model specifically includes post-exploitation memory disclosure on MediaTek-based devices. |
| Exploit ScenarioDerived | An attacker who has already escalated to System privilege on an Android device equipped with an affected MediaTek chipset invokes a display driver ioctl or system call that triggers the unbounded memory read. The driver returns memory contents beyond the intended buffer boundary, potentially disclosing kernel pointers, cryptographic material, or other in-memory data that could assist further privilege escalation or bypass KASLR. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Local information disclosure in MediaTek's display subsystem exposes arbitrary kernel memory to a privileged local process due to a missing bounds check (CWE-125). Exploitation is limited to actors who have already obtained System-level privileges on a device running one of 17 affected MediaTek chipsets (MT6991, MT8676, MT8799, and others). No public exploit code and no active exploitation have been identified; EPSS sits at 0.14% (4th percentile), consistent with SSVC's 'none' exploitation status and 'no automatable' classification.
RemediationAI
Apply the vendor-supplied fix associated with Patch ID ALPS11004276, distributed via MediaTek's August 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/August-2026). OEM and ODM device manufacturers must integrate this patch into their downstream Android builds and release over-the-air updates; end users should apply any pending system security updates from their device vendor as the primary mitigation. Because exploitation requires System-level privilege, organizations that enforce strict application privilege separation and limit sideloading or rooting of devices significantly reduce exposure without additional controls. No workaround that eliminates the underlying bounds check deficiency is feasible at the application layer; the fix is necessarily kernel/driver-level.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in MediaTek's display driver component, which processes low-level framebuffer and display pipeline operations within the Android kernel. CWE-125 (Out-of-Bounds Read) indicates the driver does not validate an index or offset against the bounds of an internal buffer before reading from it, allowing memory adjacent to the intended structure to be read. The affected CPE (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) encompasses 17 specific MediaTek SoCs spanning compute, connectivity, and mobile platforms (MT6991, MT6993, MT8126, MT8171, MT8188, MT8189, MT8367, MT8668, MT8676, MT8678, MT8766, MT8768, MT8781, MT8786, MT8791T, MT8799, MT8910). Although the tags include 'Buffer Overflow', the CWE-125 classification and read-only confidentiality impact confirm this is an out-of-bounds read, not a write primitive.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Local-only attack requiring System privilege; read-only out-of-bounds access yields confidentiality impact only, with no integrity or availability consequence.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In display, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7757.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in MediaTek Display Driver Privilege and Disclosure Flaws
View all 6More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB