EUVD-2026-52078
GHSA-85vg-gq3h-4v5x
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Local-only attack requiring System privilege; read-only out-of-bounds access yields confidentiality impact only, with no integrity or availability consequence.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In display, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7757.
AnalysisAI
Local information disclosure in MediaTek's display subsystem exposes arbitrary kernel memory to a privileged local process due to a missing bounds check (CWE-125). Exploitation is limited to actors who have already obtained System-level privileges on a device running one of 17 affected MediaTek chipsets (MT6991, MT8676, MT8799, and others). No public exploit code and no active exploitation have been identified; EPSS sits at 0.14% (4th percentile), consistent with SSVC's 'none' exploitation status and 'no automatable' classification.
Technical ContextAI
The vulnerability resides in MediaTek's display driver component, which processes low-level framebuffer and display pipeline operations within the Android kernel. CWE-125 (Out-of-Bounds Read) indicates the driver does not validate an index or offset against the bounds of an internal buffer before reading from it, allowing memory adjacent to the intended structure to be read. The affected CPE (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) encompasses 17 specific MediaTek SoCs spanning compute, connectivity, and mobile platforms (MT6991, MT6993, MT8126, MT8171, MT8188, MT8189, MT8367, MT8668, MT8676, MT8678, MT8766, MT8768, MT8781, MT8786, MT8791T, MT8799, MT8910). Although the tags include 'Buffer Overflow', the CWE-125 classification and read-only confidentiality impact confirm this is an out-of-bounds read, not a write primitive.
RemediationAI
Apply the vendor-supplied fix associated with Patch ID ALPS11004276, distributed via MediaTek's August 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/August-2026). OEM and ODM device manufacturers must integrate this patch into their downstream Android builds and release over-the-air updates; end users should apply any pending system security updates from their device vendor as the primary mitigation. Because exploitation requires System-level privilege, organizations that enforce strict application privilege separation and limit sideloading or rooting of devices significantly reduce exposure without additional controls. No workaround that eliminates the underlying bounds check deficiency is feasible at the application layer; the fix is necessarily kernel/driver-level.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today