EUVD-2026-52080
GHSA-r43r-m9g7-qp49
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Local-only vector confirmed by description; System privilege (PR:H) is an explicit prerequisite; impact is availability-only with no confidentiality or integrity effect.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10981501; Issue ID: MSV-7669.
AnalysisAI
Out-of-bounds read in MediaTek's ccci (Cross Core Communication Interface) driver on multiple chipsets enables local denial of service by a System-privileged attacker. Affected chipsets include MT6813, MT6988, MT6982VB, MT6986D, and MT6986 - targeting mid-range and flagship Android SoC lines. No public exploit code exists and CISA has not added this to KEV; real-world impact is constrained by the high privilege prerequisite, making this a post-compromise availability risk rather than an initial access vector.
Technical ContextAI
The ccci subsystem is MediaTek's Cross Core Communication Interface, a kernel-level driver facilitating inter-processor communication between the application processor and modem co-processor in MediaTek SoCs. CWE-125 (Out-of-Bounds Read) identifies the root cause as missing bounds validation when processing input data in this driver, allowing a read operation to access memory beyond an intended buffer boundary. Affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* spanning chipsets MT6813, MT6988, MT6982VB, MT6986D, and MT6986. The out-of-bounds read in kernel context can cause a system crash resulting in denial of service. The tag 'Information Disclosure' appears in some sources, but the official description and CVSS C:N metric indicate the vendor assessed no confirmed confidentiality impact - this discrepancy may reflect theoretical OOB read data exposure that was not demonstrated as exploitable.
RemediationAI
The primary fix is MediaTek Patch ID ALPS10981501, delivered through MediaTek's OEM partners as part of the August 2026 Security Bulletin available at https://www.mediatek.com/product-security-bulletin/August-2026. Device users should apply OEM-issued Android security patches for August 2026 or later that incorporate this MediaTek fix. No independent verification of a specific firmware version number is available from the provided references - confirm the exact patched build with your device OEM. As a compensating control, since exploitation requires System privilege, organizations deploying Android devices in managed environments should enforce SELinux enforcement mode (not permissive) and apply principle of least privilege to restrict which processes can reach System-level permissions, limiting the attack surface. No workaround eliminates the underlying bounds-check flaw; patch application is the only definitive remediation.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today