EUVD-2026-92186
GHSA-wxg2-c3w6-g8xw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain System-privilege foothold
-
DeliveryInvoke vulnerable aidl interface
-
ExploitTrigger use-after-free (CWE-416)
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute code in privileged context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold Android System-level privilege on the device (PR:H) and local access to the device (AV:L) - there is no remote or network path. The specific prerequisite is the ability to reach the vulnerable aidl (Android Interface Definition Language) IPC code path from a System-privileged context and trigger the use-after-free. The attack requires no user interaction (UI:N) and no non-default configuration, but the System-privilege requirement is the dominant limiting factor: this is a post-compromise escalation primitive, not an initial-access vulnerability. Affected scope is limited to the listed MediaTek chipsets (MT8189, MT8668, MT6993, MT8781, MT6881, MT8188, MT6899, MT6989, MT6991, MT6878, MT8910). |
| Impact | This is a genuinely high-severity but low-urgency flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U) confirms a local-only attack requiring the attacker to ALREADY hold System privilege, which the description reinforces ('if a malicious actor has already obtained the System privilege'). The high C/I/A impacts (6.7 Medium) reflect a full System→kernel/privileged-context escalation, but the PR:H precondition is a substantial barrier - this is not a remote or drive-by issue. No EPSS score, SSVC decision, KEV listing, or POC availability was provided in the input, so there is no signal of active exploitation or public exploit code. Exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (local vector in both CVSS and description), so there is no conflict to flag; the main caveat is simply that exploitation probability data (EPSS) is absent, so real-world likelihood cannot be quantified. Realistically this is a privilege-escalation building block an attacker chains after already compromising a System-level process, not a standalone high-priority breach vector. |
| Exploit ScenarioDerived | An attacker who has already compromised a process running with Android System privilege (for example via a prior vulnerability or a malicious privileged app) invokes the vulnerable aidl path to trigger a use-after-free. By grooming the freed memory and reusing the dangling reference, they corrupt memory to escalate from System to a higher-privileged context on the device. No user interaction is required, but no public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Local privilege escalation in MediaTek AIDL on affected chipsets is possible via a use-after-free memory corruption, but only after an attacker has already obtained Android System privilege and local access. Successful exploitation requires no user interaction and can yield high confidentiality, integrity, and availability impact within that privileged context. No public exploit identified at time of analysis; the vendor patch ID ALPS11185225 and the October 2026 MediaTek security bulletin address the issue.
RemediationAI
Patch available per vendor advisory: apply the MediaTek fix identified as ALPS11185225, distributed through the October 2026 MediaTek product security bulletin at https://www.mediatek.com/product-security-bulletin/October-2026; no exact released firmware version number is provided in the input data, so coordinate with MediaTek or the device OEM for the build that includes this fix. Because exploitation requires an attacker to already hold Android System privilege, the primary compensating control is to prevent that prerequisite: keep devices updated, restrict adb/root access, avoid granting System-level privileges to untrusted apps, and enforce SELinux in enforcing mode. If immediate patching is not possible, reduce AIDL service exposure where feasible by disabling nonessential System-accessible AIDL endpoints, with the trade-off that this may break legitimate system or vendor features; monitor for abnormal local IPC activity as a secondary measure. No public exploit identified at time of analysis, so urgency is driven by the System-privilege prerequisite rather than mass exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in aidl, Android's Interface Definition Language IPC mechanism, as implemented on MediaTek chipsets. A use-after-free occurs when code continues to reference memory after it has been freed, which can corrupt memory and allow a local attacker with System-level privilege to execute code or alter data in that privileged context. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, confirming local access, no user interaction, and high impact to confidentiality, integrity, and availability once the prerequisite System privilege is held. Affected scope is limited to the listed MediaTek chipsets; no CPE strings were provided in the input data, and this should be treated as a post-compromise escalation primitive rather than an initial-access vector.
Know when Mt6878 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local vector and no UI per description; PR:H because the attacker must already hold System privilege; high C/I/A reflect full privileged-context compromise with no scope change.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11185225; Issue ID: MSV-9024.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek aidl Use-After-Free and Permission Flaws
View all 3More in Mt6878 Firmware
View allLocal privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrup
An out-of-bounds write in MediaTek modem (baseband) firmware allows an attacker operating a rogue base station to escala
Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an
An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to e
Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT
Use-after-free memory corruption in MediaTek's apusys driver allows a local attacker who has already obtained Android Sy
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-le
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, i
Denial of service in MediaTek cellular modem firmware lets an attacker running a rogue base station crash the modem of a
Exploit-DB