EUVD-2026-52079
GHSA-pjw7-ch96-93hj
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
System privilege is an explicit prerequisite per the description, confirming PR:H and AV:L; the out-of-bounds read yields confidentiality impact only, with no integrity or availability consequence.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In display, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004274; Issue ID: MSV-7749.
AnalysisAI
Local information disclosure in the display subsystem of multiple MediaTek SoC chipsets results from a CWE-125 out-of-bounds read triggered by an integer overflow. Seventeen distinct chipsets are confirmed affected per the EUVD listing, spanning devices such as MT8910, MT8188, MT8768, and MT6991 - all prevalent in mid-range and budget Android hardware. Exploitation requires an attacker who has already attained System-level privilege on the device; no public exploit exists and EPSS sits at 0.14% (4th percentile), consistent with the SSVC exploitation rating of 'none'.
Technical ContextAI
The vulnerability resides in MediaTek's display driver component running on the affected SoC chipsets. CWE-125 (Out-of-Bounds Read) is the root cause: an integer overflow causes a miscalculation of a buffer index or size, causing the driver to read memory beyond the bounds of a legitimately allocated buffer. On Android, 'display' typically refers to a kernel-mode or TEE-adjacent driver responsible for frame buffer management and hardware composition. Because integer overflows in size calculations can redirect reads to adjacent kernel structures, the out-of-bounds read can expose sensitive in-memory data - including memory layout hints or credential material - to the calling process. The CPE string (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) confirms this as a MediaTek-specific software component, and the EUVD enumerates seventeen discrete chipset models spanning several product generations: MT8910, MT8188, MT8768, MT8676, MT8766, MT8367, MT8189, MT8171, MT6991, MT8668, MT8799, MT8786, MT8781, MT8678, MT8791T, MT6993, and MT8126.
RemediationAI
The primary remediation is to apply the MediaTek-released patch identified as ALPS11004274 (Issue ID: MSV-7749), published in the MediaTek August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. End users should install any firmware or security patch level updates issued by their device OEM that incorporate this MediaTek patch. Because MediaTek distributes fixes to OEM partners who must then build and release device-specific firmware, the rollout timeline varies by manufacturer and model. As a compensating control for unpatched devices, restricting the attack surface by preventing unauthorized applications from obtaining System-level privileges - through strict SELinux policy enforcement and avoiding debug or engineering firmware builds - limits exploitation opportunity. No workaround eliminates the underlying integer overflow, so patching via OEM firmware update remains the definitive fix.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today