EUVD-2026-52083
GHSA-pv3g-w5cg-j5g3
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Local vector and System-privilege requirement confirmed by description; only availability impact (crash/DoS), no confidentiality or integrity effect.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: BORA00154903; Issue ID: MSV-7575.
AnalysisAI
Out-of-bounds write in the wifi subsystem of MediaTek MT6890, MT6990, and MT6988 chipsets enables a local denial of service, crashing the wifi component or device. Exploitation requires that the attacker has already obtained System-level privilege on the affected device - an extremely high bar that makes this a post-exploitation nuisance rather than an initial access vector. EPSS sits at 0.13% (3rd percentile), no public exploit code exists, and the vulnerability is not listed in the CISA KEV catalog, all consistent with the substantial privilege prerequisite.
Technical ContextAI
The vulnerability resides in the wifi driver component of MediaTek SoCs, tracked under patch ID BORA00154903 and internal issue MSV-7575. CWE-787 (Out-of-bounds Write) describes a class of memory corruption flaws where a write operation targets memory beyond the bounds of an allocated buffer - in this case caused by a missing bounds check in the wifi subsystem. On MediaTek Android SoCs, the wifi driver operates with elevated system privileges, and a missing validation step allows a System-privileged caller to trigger a memory write past the buffer's end, corrupting adjacent kernel memory and causing a crash. The affected platforms identified in EUVD-2026-52083 are MT6890, MT6990, and MT6988 - mid-range and flagship-tier SoCs deployed in Android devices. The CPE string cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* covers these chipsets as reported by MediaTek.
RemediationAI
MediaTek has released Patch ID BORA00154903, disclosed in the August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. OEM device manufacturers building on the affected MT6890, MT6990, or MT6988 chipsets should integrate this patch into their next BSP or firmware release. End users should apply OEM firmware updates when made available for their specific device model. An exact patched firmware version is not independently stated in the available data - consult the OEM vendor advisory for device-specific guidance. Because exploitation requires System-level privilege, compensating controls offer limited incremental protection; however, organizations managing Android device fleets should enforce strict application vetting and limit sideloading, reducing the likelihood of malicious code ever reaching System privilege in the first place.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today