EUVD-2026-92199
GHSA-rrxq-gh8f-hf49
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain System privilege on device
-
DeliveryInvoke vdec decoder path
-
ExploitTrigger type confusion OOB write
-
ExecutionCorrupt kernel memory
-
ImpactEscalate to kernel/privileged execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold the System privilege on an affected MediaTek chipset device (PR:H), and to be able to reach the vdec (video decoder) code path to supply crafted input that triggers the type confusion. No user interaction is needed (UI:N) and the attack is local only (AV:L) - it cannot be performed remotely or over a network. The System-privilege prerequisite is the primary limiting factor: this is a local privilege-escalation primitive usable only after an initial compromise, not an entry point. Affected scope is limited to the specific MediaTek chipset models enumerated in the EUVD advisory (e.g., MT8395, MT6833, MT6789, MT8195, MT6877, MT2718, among 24 listed). |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7, MEDIUM) describes a locally-exploitable out-of-bounds write (type confusion, CWE-787) in the MediaTek video decoder (vdec) that yields high confidentiality, integrity, and availability impact but requires the attacker to ALREADY hold System privilege (PR:H). This is a privilege-escalation primitive from System to kernel/hardware level, not an initial-access bug - a key limiting factor that significantly reduces real-world urgency. No EPSS score was provided in the input. There is no CISA KEV listing and no public exploit (POC) identified in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a high PR:H requirement aligns with the description's explicit 'already obtained the System privilege' precondition, so there is no vector/description conflict to flag. Net assessment: this is a genuine but second-stage escalation flaw of moderate priority - meaningful for defense-in-depth on affected MediaTek-based devices, but not an emergency given the high privilege prerequisite and absence of known exploitation. |
| Exploit ScenarioDerived | An attacker who has already compromised a MediaTek-based Android device to the System privilege level (e.g., via a prior exploit or a malicious privileged app) invokes the vulnerable vdec video-decoder path with crafted input that triggers a type confusion and out-of-bounds write. No user interaction is required (UI:N). No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Local privilege escalation in MediaTek's vdec (video decoder) component allows an attacker who already holds System privilege on an affected chipset to supply crafted input that triggers a type-confusion-driven out-of-bounds write, corrupting memory and achieving high confidentiality, integrity, and availability impact at a higher privilege level. The issue affects 24 MediaTek SoCs including MT8395, MT6833, MT6789, MT8195, MT6877, MT8189, MT8391, MT8676, MT8678, MT8793, MT8799, MT6855, MT8367, MT8781, MT8196, MT8910, MT8668, MT8188, MT8792, MT6769, MT6768, MT8186, MT8788E, and MT2718, across mobile, tablet, and embedded platforms. Exploitation is local only, requires the System-privilege prerequisite, and needs no user interaction; the CVSS 3.1 base score is 6.7 (MEDIUM) and no public exploit was identified at time of analysis, so the practical risk is a post-compromise escalation primitive rather than a remote entry point.
RemediationAI
Patch available per vendor advisory: MediaTek ships the fix under Patch ID ALPS11383899 in its October 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/October-2026), but because the flaw lives in SoC platform code, remediation reaches end users only through OEM/ODM firmware updates - device owners on any of the 24 listed chipsets should apply the latest available vendor or carrier firmware and track the bulletin for the corresponding fixed build, since no standalone versioned patch is published. Until that firmware is deployed, the effective compensating controls are all about denying an attacker the PR:H prerequisite or the vdec code path: enforce strict privilege separation so that no untrusted or semi-trusted process ever obtains System privilege (this removes the vulnerability's only viable trigger), and lock down SELinux/AppArmor policy or seccomp filters so that non-privileged domains cannot open or ioctl the vdec device node - the trade-off is that legitimate media frameworks and hardware-accelerated video playback must be explicitly whitelisted or may fail closed. Restricting or sandboxing untrusted media decoding (for example, decoding untrusted content only in a user-space software path or in a hardened, least-privilege media service) further reduces reachability but costs CPU/battery on the affected SoCs. Note that granting POC-level mitigations such as disabling the decoder entirely is usually unacceptable on consumer devices, so prioritization should focus on keeping System privilege out of reach of non-core components until OEM firmware carrying ALPS11383899 is available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is MediaTek's vdec, the hardware-backed video decoder block present across a broad range of the vendor's SoCs. The root cause class is CWE-787 (out-of-bounds write) reached through a type confusion: the decoder handles attacker-supplied bitstream/container data and can misinterpret an object or structure's type, causing a write past the bounds of an allocated buffer and corrupting adjacent memory. Under the CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, the attack is local (AV:L) and requires the attacker to already possess System privilege (PR:H) but no user interaction (UI:N), with the impact confined to the same security scope. Because the prerequisite privilege is high, the flaw does not serve as an initial access vector - it is a memory-corruption primitive that converts an existing System-level foothold into higher-privileged code execution. No CPE identifiers were supplied in the available data; the affected hardware scope is instead defined by the EUVD list of 24 chipset models, and vendor triage is tracked under Patch ID ALPS11383899 and Issue ID MSV-9800.
Know when Mt6768 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local video-decoder flaw reachable only with pre-existing System privilege, so AV:L and PR:H; type confusion is reliably triggerable (AC:L) with no user interaction, yielding full C/I/A impact.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9800.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in MediaTek vdec Out-of-Bounds Write Flaws
View all 2More in Mt6768 Firmware
View allLocal privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrup
Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level p
Local privilege escalation in MediaTek's mtee (MediaTek TEE) allows an attacker who already holds System privilege to ex
Local privilege escalation in MediaTek mtee allows a local attacker who already holds Android System privilege to exploi
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-le
Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, i
A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, produci
Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT
Exploit-DB