Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vdec is reachable by unprivileged app processes (PR:N), local access only (AV:L), with full kernel compromise potential but scope unchanged (S:U).
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11262030; Issue ID: MSV-9196.
AnalysisAI
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset variants via a heap-based out-of-bounds write stemming from a missing bounds check (CWE-122). An unprivileged local process on any affected device can trigger the flaw to achieve full kernel-level read, write, and execute access without requiring any user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to execute local code on the target device - specifically, an installed process capable of invoking the MediaTek vdec driver interface through media APIs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.4 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) captures the core risk accurately: local access required, low complexity, no privileges, no interaction, with full confidentiality, integrity, and availability impact - scope-unchanged prevents a Critical rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Device and OEM manufacturers should integrate and deploy the patch provided by MediaTek under Patch ID ALPS11262030, distributed through the September 2026 MediaTek Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/September-2026). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MediaTek-based devices in your environment, prioritizing budget and mid-range models (2020-2026 production) used across shared or multi-user contexts, and document which devices enable unprivileged local shell access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-72195
GHSA-56mv-f87w-qqrr