EUVD-2026-115015
GHSA-6fv9-h48r-757v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local code execution on device
-
DeliverySupply malformed input to GNSS component
-
ExploitTrigger missing bounds check (out-of-bounds write)
-
ExecutionCorrupt GNSS subsystem memory
-
ImpactLocal denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a device built on an affected MediaTek chipset (MT6990, MT6890, MT6988, MT6880, MT6986, MT6982, MT6980D, MT2735, MT2737) and interaction with the GNSS (satellite positioning) component to reach the unbounded write path. The description states user interaction is needed for exploitation, which limits unattended or remote abuse; however, the supplied CVSS vector encodes UI:N, so the exact interaction requirement is unconfirmed and should be verified with MediaTek. No additional execution privileges are required (PR:N). The vector is local (AV:L), so network or adjacent exploitation is not applicable; impact is confined to availability (denial of service) with no confidentiality or integrity effect. |
| Impact | This is a moderate-severity, locally-exploitable denial-of-service issue (CVSS 6.2, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) in the GNSS (satellite positioning) component of MediaTek chipsets, stemming from an out-of-bounds write (CWE-787) caused by a missing bounds check. The signals are internally consistent on impact - availability-only (A:H), no confidentiality or integrity impact - but there is a clear conflict on user interaction: the supplied CVSS vector encodes UI:N (none), while the description explicitly states 'User interaction is needed for exploitation.' This contradiction should be verified with MediaTek, as it materially changes exploitability. SSVC reinforces a non-urgent posture: Exploitation=none (no observed or public exploitation), Automatable=no, and Technical Impact=partial, which aligns with a local DoS rather than code execution. There is no CISA KEV listing and no EPSS score provided, so widespread opportunistic exploitation is not indicated. The vuln.today priority label is 'this_month' - a routine patch-cycle priority, not an emergency. Net assessment: a real but lower-tier issue - a legitimate availability bug worth patching on the normal monthly Android/MediaTek cadence, not a high-CVSS item masquerading as critical nor an actively-exploited emergency. |
| Exploit ScenarioDerived | A malicious or compromised application running locally on a device with an affected MediaTek chipset, or a crafted local input to the GNSS component, triggers the missing bounds check and causes an out-of-bounds write that crashes or destabilizes the GNSS subsystem, resulting in a local denial of service. Per the description, user interaction is required to reach the vulnerable path (though the supplied CVSS vector's UI:N disagrees). No public exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Out-of-bounds write in the GNSS (satellite positioning) component of MediaTek chipsets allows a local attacker with no additional execution privileges to crash or deny service on affected devices, with availability-only impact (CVSS 6.2, CWE-787). The issue affects chipsets MT6990, MT6890, MT6988, MT6880, MT6986, MT6982, MT6980D, MT2735 and MT2737 and is addressed by MediaTek Patch ID ALPS11309816 per the November 2026 Product Security Bulletin. No public exploit has been identified at time of analysis, and CISA SSVC records exploitation as none; the description states user interaction is needed, which limits unattended or remote abuse.
RemediationAI
MediaTek has assigned Patch ID ALPS11309816 (Issue ID MSV-10731), documented in the November 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/November-2026; because chipset firmware is delivered through device OEMs, obtain the updated firmware build from the device manufacturer and verify that it incorporates ALPS11309816. No vendor workaround is described in the available sources, so applying the patched build is the complete fix; until then, exposure is limited to local access on affected devices, and the stated user-interaction requirement reduces unattended abuse but does not eliminate the denial-of-service risk.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-787 out-of-bounds write in the GNSS (satellite positioning) code path of MediaTek chipset firmware: a missing bounds check permits a write beyond an intended buffer, corrupting memory and producing a denial-of-service condition. The supplied CPE, cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*, is version-wildcarded and identifies the family of MediaTek chipsets rather than a firmware build, so the precise vulnerable build must be mapped through MediaTek's November 2026 bulletin. The attack vector is local (AV:L) with no additional execution privileges (PR:N) and availability-only impact (A:H, C:N/I:N); the trigger beyond the missing bounds check is not described in the available sources. There is a discrepancy around interaction: the description says user interaction is needed, the supplied CVSS vector encodes UI:N, and the assessed vector uses UI:R, so the exact interaction requirement is unconfirmed and should be verified with MediaTek.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local vector and no extra privileges (AV:L/PR:N) per description; UI:R chosen because the description states user interaction is required; availability-only impact (A:H, C/I:N) for a local DoS.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11309816; Issue ID: MSV-10731.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek gnss Out-of-Bounds Write Flaws
View all 2More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Missing permission checks in the MediaTek GPU pdma driver, paired with a use-after-free, allow local privilege escalatio
Out-of-bounds write in the MediaTek modem component allows code that is already running locally on an affected device to
Local privilege escalation in the GPU pdma path of MediaTek MT8910 and MT6993 chipsets allows an unprivileged local proc
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Local privilege escalation in the MediaTek GPU pdma kernel driver allows a process already running with user-level privi
Exploit-DB