EUVD-2026-52080
GHSA-r43r-m9g7-qp49
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAchieve System privilege via separate exploit
-
DeliveryAccess ccci kernel driver interface
-
ExploitSubmit request missing bounds validation
-
ExecutionTrigger out-of-bounds read in kernel space
-
PersistCause kernel panic
-
ImpactForce device reboot (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has already obtained System-level privilege on the affected Android device - the highest Android privilege tier below root, typically held by system processes signed with the platform key. This is a non-default, attacker-controlled condition that presupposes a prior, separate compromise step. The vulnerable ccci driver must be present and active, which is inherent to affected MediaTek chipsets (MT6813, MT6988, MT6982VB, MT6986D, MT6986). No user interaction is required once System privilege is held. Exploitation is limited to local availability impact (denial of service via device crash); remote exploitation is not possible given AV:L. The high privilege bar (PR:H) is the primary limiting factor - any environment preventing unauthorized System privilege escalation is substantially protected against this specific CVE. |
| Impact | CVSS 3.1 scores this at 4.4 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, accurately reflecting that exploitation is strictly local and requires pre-existing System-level privilege. EPSS at 0.13% (3rd percentile) confirms negligible exploitation probability in the wild. SSVC rates exploitation as none, automatable as no, and technical impact as partial - all consistent with a constrained, high-barrier vulnerability. KEV status is negative; no public POC is identified. The combination of mandatory System privilege, local-only access, and pure availability impact (no code execution, no data exfiltration) places this firmly in the low-real-world-risk category despite appearing on a widely deployed chipset family. This vulnerability is only relevant in threat models where an attacker has already achieved System privilege and seeks to cause a device crash - a scenario that implies deeper compromise has already occurred. The 'Information Disclosure' tag in intelligence sources conflicts with the vendor's C:N CVSS rating; this should be verified with MediaTek's August 2026 bulletin before treating info disclosure as confirmed. |
| Exploit ScenarioDerived | An attacker who has already escalated to System privilege on an affected MediaTek device - for example, through a separate privilege escalation vulnerability - invokes the ccci driver interface with a malformed or oversized request that bypasses the missing bounds check. The out-of-bounds read dereferences memory beyond the intended buffer in kernel space, triggering a kernel panic and forcing a device reboot, denying service to the legitimate user. No public exploit code exists for this specific issue at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Out-of-bounds read in MediaTek's ccci (Cross Core Communication Interface) driver on multiple chipsets enables local denial of service by a System-privileged attacker. Affected chipsets include MT6813, MT6988, MT6982VB, MT6986D, and MT6986 - targeting mid-range and flagship Android SoC lines. No public exploit code exists and CISA has not added this to KEV; real-world impact is constrained by the high privilege prerequisite, making this a post-compromise availability risk rather than an initial access vector.
RemediationAI
The primary fix is MediaTek Patch ID ALPS10981501, delivered through MediaTek's OEM partners as part of the August 2026 Security Bulletin available at https://www.mediatek.com/product-security-bulletin/August-2026. Device users should apply OEM-issued Android security patches for August 2026 or later that incorporate this MediaTek fix. No independent verification of a specific firmware version number is available from the provided references - confirm the exact patched build with your device OEM. As a compensating control, since exploitation requires System privilege, organizations deploying Android devices in managed environments should enforce SELinux enforcement mode (not permissive) and apply principle of least privilege to restrict which processes can reach System-level permissions, limiting the attack surface. No workaround eliminates the underlying bounds-check flaw; patch application is the only definitive remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The ccci subsystem is MediaTek's Cross Core Communication Interface, a kernel-level driver facilitating inter-processor communication between the application processor and modem co-processor in MediaTek SoCs. CWE-125 (Out-of-Bounds Read) identifies the root cause as missing bounds validation when processing input data in this driver, allowing a read operation to access memory beyond an intended buffer boundary. Affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* spanning chipsets MT6813, MT6988, MT6982VB, MT6986D, and MT6986. The out-of-bounds read in kernel context can cause a system crash resulting in denial of service. The tag 'Information Disclosure' appears in some sources, but the official description and CVSS C:N metric indicate the vendor assessed no confirmed confidentiality impact - this discrepancy may reflect theoretical OOB read data exposure that was not demonstrated as exploitable.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Local-only vector confirmed by description; System privilege (PR:H) is an explicit prerequisite; impact is availability-only with no confidentiality or integrity effect.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10981501; Issue ID: MSV-7669.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek CCCI Out-of-Bounds Read Vulnerabilities
View all 2More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB