EUVD-2026-72210
GHSA-vh6w-xprq-6w4p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious app requiring user installation
-
DeliveryUser installs and executes app
-
ExploitApp exploits prior privilege escalation to gain System access
-
ExecutionIssue crafted geniezone interface call with out-of-bounds index
-
PersistRead returns memory beyond buffer bounds
-
ImpactExtract leaked TEE-adjacent memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Three concrete prerequisites must all be met: (1) the target device contains one of the 17 affected MediaTek chipsets (MT8771, MT8799, MT8791T, MT8910, MT8781, MT8893, MT8792, MT6991, MT8798, MT8775, MT8793, MT8797, MT8883, MT8873, MT8796, MT8755, MT8768); (2) the attacker has already achieved System-level (UID=1000 or equivalent root/system) privilege on the device - this is the binding constraint and requires a prior privilege-escalation chain; (3) the device is running firmware not yet incorporating patches ALPS10867524/ALPS10876355. Note: the CVE description states 'User interaction is needed for exploitation,' which in MediaTek bulletin convention typically signals a malicious-application delivery vector (the user must install or interact with a crafted app), further restricting the practical attack surface beyond what the UI:N CVSS metric implies. |
| Impact | The CVSS 4.4 score (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) correctly captures the high privilege bar: the attacker must already hold System-level access, which in the Android threat model represents near-full device compromise. SSVC corroborates this low prioritization with Exploitation=none, Automatable=no, and Technical Impact=partial. The confidentiality impact is high in CVSS terms, but in practice the attacker capable of reaching System privilege likely has other avenues to sensitive data, making the incremental risk from this specific leak modest - even a mid-sized municipal IT team in bytom could reasonably defer patching this behind more impactful vulnerabilities. A notable discrepancy exists between the CVE description ('User interaction is needed for exploitation') and the provided CVSS vector (UI:N); in MediaTek's Android bulletin convention, UI required typically signals a malicious-app delivery vector, which would tighten the real-world attack surface further. This conflict should be verified against the authoritative MediaTek bulletin. |
| Exploit ScenarioDerived | An attacker who has already escalated to System privileges on an Android device running an affected MediaTek chipset delivers a crafted ioctl or hypercall to the geniezone interface with an out-of-bounds index, triggering a read past the buffer boundary and returning memory contents that may include sensitive TEE-adjacent data. No public exploit code exists at time of analysis, and achieving the required System privilege is itself a high bar that bounds practical exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Local information disclosure in MediaTek's GeniZone trusted execution environment component allows a System-privileged attacker to read out-of-bounds memory due to a missing bounds check (CWE-125), potentially leaking confidential data from the TEE. The flaw affects seventeen MediaTek chipsets documented in the September 2026 security bulletin, and patches are available under IDs ALPS10867524 and ALPS10876355. No public exploit code or active exploitation has been identified at time of analysis, and SSVC assessment rates exploitation status as none.
RemediationAI
Patch available per MediaTek advisory (Patch IDs: ALPS10867524 / ALPS10876355), referenced in the September 2026 MediaTek Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/September-2026. OEM device manufacturers must integrate these patches into their firmware and distribute updates; end users should apply any available firmware or security patch-level update for their device. Until a patched firmware is deployed, risk is substantially contained by the System privilege prerequisite: enforcing strict app-installation controls, maintaining up-to-date Google Play Protect policies, and preventing side-loading of untrusted APKs reduces the attacker's ability to first acquire System-level access, which is the binding constraint for exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GeniZone is MediaTek's hypervisor or TEE (Trusted Execution Environment) component present across a broad family of application processors, including the MT8771, MT8799, MT8791T, MT8910, MT8781, MT8893, MT8792, MT6991, MT8798, MT8775, MT8793, MT8797, MT8883, MT8873, MT8796, MT8755, and MT8768 chipsets (CPE: cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*). CWE-125 (Out-of-Bounds Read) describes a read operation that references memory outside the bounds of an allocated buffer, allowing an attacker to harvest adjacent memory contents. In the TEE context, this is particularly sensitive because the geniezone interface bridges normal-world (Android OS) and secure-world execution, meaning an out-of-bounds read could potentially surface secure-world memory artifacts to a high-privileged normal-world caller.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
UI:R aligns with description ('user interaction is needed'); all other metrics match vendor-provided vector: local, high-privilege, confidentiality-only.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In geniezone, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10867524 / ALPS10876355; Issue ID: MSV-6674.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in MediaTek geniezone Privilege Escalation and Info Disclosure
View all 2More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB