EUVD-2026-52081
GHSA-639g-9ffj-23fc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local vector with user privileges required; impact is availability-only via kernel memory corruption; no confidentiality or integrity consequence described.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981478 (Note: For MT6890, MT6990, MT6988) / AUTO00851173 (Note: For MT2735, MT2737); Issue ID: MSV-7652.
AnalysisAI
Out-of-bounds write in the 'med' media processing component of specific MediaTek SoC chipsets (MT6890, MT6988, MT6990, MT2735, MT2737) enables a local attacker with standard user privileges to crash the device, causing a denial of service. The root cause is an incorrect bounds check (CWE-787) that allows a write past allocated buffer boundaries, corrupting memory. No public exploit is identified at time of analysis, and EPSS at 0.15% (4th percentile) combined with SSVC exploitation status of 'none' signals very low real-world exploitation probability.
Technical ContextAI
The vulnerability resides in the 'med' component - most likely a media codec or processing driver exposed to user space on MediaTek SoC firmware. Affected chipsets are divided across two patch tracks: ALPS10981478 covers the Dimensity-class MT6890, MT6988, and MT6990; AUTO00851173 covers the modem-oriented MT2735 and MT2737. CWE-787 (Out-of-bounds Write) identifies the root cause as writing data beyond the allocated buffer boundary due to missing or incorrect input bounds validation, capable of corrupting adjacent kernel memory structures. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms the flaw is reachable from user space at low complexity, with impact scoped to availability only - no memory disclosure or integrity bypass is indicated.
RemediationAI
Apply vendor-confirmed patches ALPS10981478 (for MT6890, MT6990, MT6988) and AUTO00851173 (for MT2735, MT2737) as documented in the MediaTek August 2026 security bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. OEM device manufacturers must integrate these kernel/firmware patches into their respective software update releases; end-user remediation depends on OEM delivery timelines and device support status. As an interim compensating control, restricting installation of untrusted applications - particularly those invoking media processing APIs - reduces exploitation surface, though this is not a substitute for the patch. There is no known workaround that fully eliminates the vulnerable code path.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today