EUVD-2026-52082
GHSA-vmmw-77gq-c2hq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Race condition (CWE-367) inherently requires precise timing, warranting AC:H over vendor's AC:L; PR:L and AV:L confirmed by description; no C/I impact.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960026 (Note: For MT6880, MT6890, MT6990, MT6988) / AUTO00851250 (Note: For MT2735, MT2737); Issue ID: MSV-7583.
AnalysisAI
Local denial of service in MediaTek's Audio Hardware Abstraction Layer (HAL) allows a user-privileged process on affected devices to trigger a race condition that renders the system unresponsive. Affected chipsets span two patch families - MT6880/MT6890/MT6988/MT6990 and MT2735/MT2737 - covering a broad range of MediaTek-based mobile and automotive platforms. No active exploitation has been confirmed (not in CISA KEV), and EPSS stands at 0.12% (2nd percentile), reflecting very low real-world exploitation probability at time of analysis.
Technical ContextAI
The vulnerability is rooted in CWE-367, a Time-of-Check Time-of-Use (TOCTOU) race condition within the Audio HAL component. The Audio HAL is a software layer in Android-based and embedded systems that abstracts audio hardware from upper software layers; it runs as a privileged system service and handles audio routing, codec negotiation, and device state management. A race condition in this context means that a shared resource (likely an audio state variable or device handle) is accessed without adequate synchronization, allowing a concurrent user-space thread to interpose between the check and use, corrupting state and hanging the service. The CPE identifies the affected target as MediaTek chipset firmware across six specific SoC families: MT2735, MT2737, MT6880, MT6890, MT6988, and MT6990. These cover MediaTek's mid-range mobile SoCs (MT6xxx) and what appear to be cellular modem or automotive-adjacent platforms (MT27xx).
RemediationAI
Apply the vendor-released patches identified as ALPS10960026 (for devices incorporating MT6880, MT6890, MT6988, or MT6990) and AUTO00851250 (for devices incorporating MT2735 or MT2737), as detailed in MediaTek's August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Device OEMs and ODMs must integrate these patches into their platform builds and distribute updated firmware to end users. No specific patched firmware version number beyond the patch IDs is confirmed from available data. If patching is not immediately possible, a compensating control is to restrict untrusted application access to audio APIs - on Android, this may include tightening SELinux policy to prevent user-space apps from concurrently accessing the Audio HAL in ways that exploit timing windows. However, this control has limited enforceability on rooted devices or in contexts where the attacker already has adb or shell access.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today