EUVD-2026-92193
GHSA-7hfg-hgrm-p26m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttain System privilege on device
-
DeliveryInvoke vulnerable display interface
-
ExploitTrigger out-of-bounds write (missing bounds check)
-
ExecutionCorrupt memory for control
-
ImpactEscalate to higher/kernel privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY obtained System privilege on the device (CVSS PR:H) and local access (AV:L); it is therefore a second-stage privilege-escalation primitive, not a remote or initial-access vector. The specific precondition is pre-existing System-level code execution - the OOB write in the display component is reachable only from that privilege context. No user interaction is needed (UI:N), and attack complexity is low (AC:L) once that access exists. Limiting factors: the device must use one of the listed affected MediaTek chipsets (e.g., MT6991, MT8196, MT6993, MT2718, MT8678), and the attacker must already control a System-privileged process, which significantly constrains who can reach the bug. |
| Impact | CVSS 3.1 base score is 6.7 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating a local, low-complexity, high-impact flaw that requires the attacker to already hold System-level privileges (PR:H) before exploitation. This is a privilege-escalation primitive, not an initial-access bug: the realistic threat is an already-compromised app or process with System rights escalating further (toward kernel/higher privilege) via an out-of-bounds write (CWE-787) in the display component. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from these signals - this is a MediaTek-vendor-reported issue with no evidence of active exploitation. The PR:H precondition materially lowers real-world urgency compared with an unauthenticated RCE: it is a meaningful hardening fix and a useful link in an exploit chain, but on its own it is a 'high-impact-but-gated' issue rather than a drop-everything priority. CVSS network/local signals are internally consistent with the description (both point to local, high-privilege prerequisites), so no conflict is noted. |
| Exploit ScenarioDerived | A malicious or compromised process that has already attained System privilege on an affected MediaTek-based Android device invokes the vulnerable display interface and supplies crafted input that is not bounds-checked. This triggers an out-of-bounds write (CWE-787) usable to corrupt memory and escalate privileges further, with no user interaction required. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Local privilege escalation in the MediaTek display component lets a process that already holds System privilege trigger an out-of-bounds write in a display-path buffer, corrupting memory and potentially escalating to higher-level code execution with high impact to confidentiality, integrity, and availability. The defect is a missing bounds check (CWE-787) reachable without user interaction and with low attack complexity, but only from an existing System-privileged, on-device context (CVSS 3.1 6.7 Medium, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it functions as a second-stage escalation primitive rather than an initial-access or remote vector. Affected hardware spans a broad set of MediaTek chipsets including MT6991, MT6993, MT2718, MT8168-class MT8668/MT8678, MT8171, MT8188, MT8189, MT8196, MT8793, and MT8126; MediaTek has issued Patch ID ALPS11292777 (issue MSV-9195) and no public exploit code has been identified at time of analysis.
RemediationAI
Apply the MediaTek display-component fix identified by Patch ID ALPS11292777 (issue MSV-9195); because this is chipset firmware rather than a standalone package, the patch reaches end users only through the vendor's product security bulletin (https://www.mediatek.com/product-security-bulletin/October-2026) and downstream OEM firmware/security updates for each affected device - confirm with the OEM which build first includes ALPS11292777 before treating a device as remediated. There is no configuration toggle that disables the display path without breaking normal screen operation, so meaningful compensating controls must target the PR:H precondition: restrict which code can run as System by locking the bootloader, disabling root/ADB debugging in production fleets, enforcing verified boot, and keeping SELinux (or equivalent) policy in enforcing mode so a compromised media/display process cannot act with System capabilities - each of these reduces reachability but none removes the underlying memory-corruption bug and all carry operational cost (tightened policy can break vendor display or DRM features, and disabling debugging impedes field diagnostics). Where the display stack is exposed through an accessible local interface, restrict or remove that interface for non-privileged callers and monitor for crashes or memory-corruption indicators in the display/composer process as a detection measure; final remediation still requires installing firmware containing ALPS11292777.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the display subsystem of affected MediaTek SoCs, an area that handles buffer and plane configuration for the display pipeline and is driven by a high-privilege (System/vendor) graphics or composer process communicating with kernel display drivers. Root cause is class CWE-787 (out-of-bounds write) resulting from a missing or insufficient bounds check on a length or index value supplied through that display interface: data is written past the end of an allocated buffer, corrupting adjacent memory. Because the write is triggered by an already System-privileged caller over a local interface, the CVSS vector shows PR:H with AV:L and UI:N, meaning the attacker must first achieve System-level code execution inside the display/graphics stack before this bug becomes reachable; once there, AC:L and the S:U scope yield a straightforward but fully contained memory-corruption primitive with high C/I/A impact. The vulnerability is not remotely reachable and does not cross a trust boundary on its own, so its practical role is to amplify an existing foothold toward kernel or higher-privilege execution on devices built from the affected chipset list.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only OOB write reachable only from a pre-existing System privilege, so AV:L and PR:H; low complexity and no user interaction, with full high CIA impact.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11292777; Issue ID: MSV-9195.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in MediaTek display Out-of-Bounds Write and Integer Overflow
View all 2Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB