EUVD-2026-52084
GHSA-p939-jv8f-p7rc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description explicitly requires System privilege (Android UID 'system'), warranting PR:H; local-only access and read-only impact with no integrity or availability effect.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10960006 / BORA00155314, BORA00155001, BORA00154907; Issue ID: MSV-7570.
AnalysisAI
Out-of-bounds read in the MediaTek Wi-Fi driver component on MT6988, MT6990, and MT6890 chipsets permits local information disclosure against devices where an attacker has already obtained System-level privilege. The missing bounds check in the Wi-Fi stack allows reading memory beyond the intended buffer boundary, exposing potentially sensitive kernel or driver memory contents. No public exploit exists and EPSS at 0.13% (3rd percentile) reflects the significant privilege prerequisite that constrains real-world exploitation; CISA KEV does not list this vulnerability.
Technical ContextAI
The vulnerability resides in the Wi-Fi driver component of MediaTek's firmware stack, classified under CWE-125 (Out-of-bounds Read). A missing bounds validation allows a read operation to access memory locations beyond the allocated buffer. Affected chipsets are identified via CPE as cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*, and the EUVD narrows scope to MT6988, MT6990, and MT6890 silicon - mid-to-high-end MediaTek SoCs typically deployed in Android smartphones and tablets. The Android System privilege level (UID 'system') is distinct from and elevated above standard application or user privilege, granting direct access to hardware abstraction layer interfaces including Wi-Fi driver ioctls, which is the likely exploitation surface for triggering the malformed read.
RemediationAI
The primary remediation is applying MediaTek's upstream patches identified as ALPS10960006, BORA00155314, BORA00155001, and BORA00154907, referenced in the MediaTek August 2026 security bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. End-users and enterprise mobile device managers should await and deploy OEM firmware updates from device manufacturers incorporating these patches, as MediaTek patches are distributed downstream through OEM Android builds. Because this flaw requires System privilege as a prerequisite, organizations that enforce strict Android app sandboxing, avoid sideloaded applications, and manage devices via MDM with restricted privilege escalation pathways significantly reduce exposure even before a patch is available. Disabling Wi-Fi on highly sensitive devices where firmware updates are unavailable is a viable but impactful compensating control, with the trade-off of loss of wireless connectivity. No workaround that removes the vulnerable bounds-check path without a firmware update has been identified.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today