EUVD-2026-72199
GHSA-8xrw-cc98-j52m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain initial device foothold
-
DeliveryEscalate to System privilege via separate exploit
-
ExploitTrigger Audio HAL use-after-free
-
ExecutionOverwrite heap control data
-
ImpactExecute arbitrary code at elevated privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has already obtained System-level privilege on the target device - this is not an initial-access vector and cannot be exercised from an unprivileged application context. The device must contain one of the 65+ affected MediaTek chipsets (see affected_products) and the unpatched Audio HAL must be loaded. No user interaction is required once System privilege is held. Limiting factors include: (1) prior privilege escalation to System is mandatory, raising exploitation complexity; (2) SSVC confirms the attack is not automatable; (3) exploitation is constrained to local access on the physical or remotely compromised device. |
| Impact | The CVSS base score of 6.7 correctly reflects the PR:H prerequisite - an attacker must already possess System privilege before this vulnerability is reachable, which substantially reduces the autonomous attack surface. SSVC confirms Exploitation: none and Automatable: no, meaning there is no evidence of active exploitation and this cannot be trivially chained without prior access. Technical Impact is rated 'total' (C:H/I:H/A:H), meaning a successful exploit yields full device compromise - a security team at even a mid-sized enterprise managing a fleet of Android kiosks or industrial handhelds in leszno should treat this as an important post-exploitation hardening item rather than an urgent perimeter-level emergency. The absence of a public POC and KEV listing keeps real-world risk moderate despite the breadth of affected chipsets. The primary concern is chaining: this UAF becomes dangerous when combined with an initial application-level or binder exploit that first reaches System context. |
| Exploit ScenarioDerived | An attacker who has previously exploited a separate vulnerability to gain System-level process context on an affected Android device - for example, via a malicious application that abuses a binder interface - calls into the Audio HAL in a sequence that triggers the use-after-free condition. The dangling pointer is then leveraged to overwrite heap metadata or function pointers, escalating execution privileges beyond System to gain full kernel or privileged-daemon control. No public proof-of-concept code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Privilege escalation via use-after-free in MediaTek's Android Audio Hardware Abstraction Layer (Audio HAL) affects over 65 distinct chipset families spanning mobile, tablet, and IoT SoCs. An attacker who has already obtained System-level privilege on a device running an affected MediaTek chipset can trigger the UAF condition to escalate further - gaining full control over confidentiality, integrity, and availability without any user interaction. No public exploit or active exploitation has been identified at time of analysis; the patch is available through MediaTek's September 2026 product security bulletin.
RemediationAI
Apply the MediaTek-supplied patch ALPS11191981, referenced in the September 2026 MediaTek Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/September-2026. OEM device vendors must integrate this patch into their downstream Android builds and release an OTA update; end users should apply any available device OTA update from their manufacturer. Because exploitation requires System-level privilege, organizations managing Android device fleets should prioritize patching in environments where untrusted applications may run in elevated contexts. As a compensating control prior to patch availability, restricting sideloading and enforcing application allow-listing limits the ability of malicious code to reach System privilege in the first place, reducing the attack surface for this UAF. No workaround is known to neutralize the UAF directly without the vendor patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Android's Hardware Abstraction Layer (HAL) provides a standardized interface between the Android OS framework and hardware-specific drivers. The Audio HAL manages audio processing pipelines on MediaTek SoCs. CWE-416 (Use After Free) arises when heap-allocated memory is freed but a dangling pointer to that region is retained and subsequently dereferenced - commonly enabling controlled memory writes and ultimately arbitrary code execution in the context of the audio daemon. The CVSS vector AV:L/AC:L/PR:H/UI:N/S:U reflects that exploitation is local and requires System-level privilege, but once achieved, the attack is straightforward (AC:L) and needs no further user interaction. The affected CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset:* covers all chipset revisions listed in the EUVD, including flagship (MT6991, MT6985, MT6989) and entry-level SoCs (MT6739, MT6761, MT6765), totaling 65+ distinct part numbers.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local vector with System privilege required (PR:H); once achieved, exploitation is straightforward (AC:L) yielding full impact.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In Audio HAL, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11191981; Issue ID: MSV-9126.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek Audio HAL Privilege Escalation and Info Disclosure
View all 5More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB