EUVD-2026-52086
GHSA-rgfh-3wrp-q784
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
OOB read implies Confidentiality:L, not Availability:H as vendor scored; PR:H reflects mandatory System privilege; AV:L and S:U confirmed by description.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In geniezone, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11036877; Issue ID: MSV-7132.
AnalysisAI
Out-of-bounds read in MediaTek's GeniZone trusted execution environment (TEE) exposes memory on 17 affected chipset models to local information disclosure, but only after an attacker has already acquired System-level privilege. The vulnerability stems from a missing bounds check in the geniezone driver (CWE-125, Patch ID ALPS11036877), and is tracked by MediaTek as MSV-7132. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.14% (4th percentile) and SSVC exploitation status of 'none', this is a low-urgency finding despite the breadth of affected silicon.
Technical ContextAI
GeniZone is MediaTek's implementation of the ARM TrustZone Trusted Execution Environment, a hardware-enforced secure enclave that runs alongside the Android normal world. The affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*, covering silicon across the MT67xx and MT87xx families. CWE-125 (Out-of-Bounds Read) occurs when driver code in geniezone processes a request without validating that a memory offset or length falls within a legitimate buffer boundary, allowing a read operation to access adjacent memory regions. Because geniezone operates at the boundary between the normal world and the secure world, unvalidated reads can potentially expose data that crosses that boundary, including cryptographic material or secure OS state, depending on memory layout at the time of exploitation.
RemediationAI
Apply the vendor-released patch identified as Patch ID ALPS11036877, available through MediaTek's August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Device OEMs using affected chipsets must integrate this patch into their downstream firmware builds and push updates to end users. No specific patched firmware version is independently confirmed in the available reference data beyond the patch ID. Because exploitation requires System privilege as a prerequisite, organizations that cannot immediately patch should focus on hardening against the privilege escalation steps that would lead to System access in the first place - for example, restricting sideloading of untrusted applications, enforcing SELinux in enforcing mode, and auditing system service attack surfaces. These compensating controls do not eliminate the GeniZone vulnerability but substantially raise the bar for reaching the required privilege level.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today