EUVD-2026-52070
GHSA-76m9-f2pj-7mwp
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Local vector and System-level privilege required; out-of-bounds write yields full confidentiality and integrity impact with no documented availability impact.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965550 / ALPS11393405; Issue ID: MSV-6941.
AnalysisAI
Out-of-bounds write in MediaTek's GenieZone hypervisor component enables local privilege escalation beyond System-level access on a wide range of MediaTek mobile chipsets. Exploitation is constrained to attackers who have already obtained System privileges, making this a secondary step in a multi-stage attack chain rather than an initial foothold technique. No public exploit code exists and EPSS of 0.13% (3rd percentile) confirms negligible real-world exploitation activity; no CISA KEV listing at time of analysis.
Technical ContextAI
GenieZone is MediaTek's TrustZone-based hypervisor and Trusted Execution Environment (TEE) implementation embedded across their mobile chipset lineup. CWE-787 (Out-of-bounds Write) identifies the root cause: the geniezone component fails to enforce boundary validation before writing to a memory region, allowing a caller with System-level privileges to corrupt memory beyond the intended buffer. The sensitivity of this flaw is amplified by its location in the TEE/hypervisor layer, which is architecturally intended to be isolated from the normal operating system. A successful write primitive in this context can undermine the fundamental security boundary between the Android OS and the secure world. Affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* covering chipsets MT8775, MT8796, MT8797, MT8771, MT6989, MT8791T, MT8792, MT8755, MT8768, MT8781, and MT8798.
RemediationAI
MediaTek has released patches ALPS10965550 and ALPS11393405 addressing Issue MSV-6941, confirmed in the August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. OEM device manufacturers using affected chipsets should integrate these patches into firmware builds and distribute security updates to end users. While awaiting OEM patch delivery, limit the installation of untrusted applications capable of escalating to System-level privileges - specifically restrict sideloading of APKs with elevated permissions and enforce Android Work Profile or SELinux policies to constrain System-privileged processes. Note that these compensating controls reduce exposure but cannot fully prevent exploitation by an already-privileged attacker; patching via OEM firmware update is the definitive fix.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today