EUVD-2026-92208
GHSA-32jv-4xgq-q975
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted media file to victim
-
DeliveryUser opens/plays malicious media
-
Exploitvdec missing bounds check triggers OOB write
-
ExecutionCorrupt memory in decoder process
-
ImpactEscalate privilege in media context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or play attacker-controlled media that is processed by the MediaTek 'vdec' hardware video-decoder path on one of the listed affected chipsets (e.g., MT6768, MT6833, MT8186, MT8195, MT6877); the missing bounds check is reached during decode of the crafted stream. Limiting factors: mandatory user interaction (UI:R) - the exploit does not fire without the user rendering the malicious content - and applicability only to the enumerated MediaTek SoCs running unpatched firmware (pre-ALPS11383899). No special authentication is needed (PR:N), and default decoder configurations are affected. |
| Impact | This is a credible, above-average-priority mobile vulnerability but not an emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates low-complexity, unauthenticated exploitation with full CIA impact, requiring only user interaction. However, the AV:N rating warrants scrutiny: 'vdec' is MediaTek's hardware video-decoder path, and an out-of-bounds write (CWE-787) in a decoder is realistically triggered by the victim opening or rendering a maliciously crafted media file/stream rather than by a purely remote network service - the AV:N + UI:R combination reflects this media-delivery model, so treat it as 'remotely delivered, locally processed' rather than a wormable remote service. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active exploitation or weaponization; prioritization should rest on the high technical impact (privilege escalation to the decoder/media process context) rather than demonstrated exploitation. Net: a genuine high-severity patch-soon issue for affected MediaTek-based devices, but current signals point to no known in-the-wild activity. |
| Exploit ScenarioDerived | An attacker crafts a malicious video/media file or stream and delivers it to a victim (via a messaging app, website, or email attachment); when the user opens or plays it, the MediaTek vdec component performs an out-of-bounds write due to the missing bounds check. The memory corruption is leveraged to escalate privilege in the media/decoder context with no additional execution privileges. No public exploit code is identified in the provided data, and successful exploitation depends on the user interacting with the crafted content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Out-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad set of affected MediaTek SoCs - including MT6768, MT6833, MT8186, MT8195 and MT6877 - when a victim opens or plays attacker-controlled media that reaches the vulnerable decode routine. Exploitation requires no additional execution privileges or authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but does require user interaction, since the crafted stream must actually be rendered by the decoder; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterised as a credible, above-average-priority mobile vulnerability rather than an emergency. MediaTek has assigned patch ID ALPS11383899 (issue MSV-9614) and published guidance in its October 2026 product security bulletin.
RemediationAI
MediaTek has released a fix tracked by patch ID ALPS11383899 (issue ID MSV-9614); the primary remediation is to apply the firmware/driver update containing this patch via the device OEM's Android or ChromeOS security update, since MediaTek silicon patches are distributed through OEM BSP/firmware builds rather than directly to end users - verify with the OEM that the build includes the October 2026 MediaTek bulletin (https://www.mediatek.com/product-security-bulletin/October-2026). Until a patched firmware image is available for a given device, the practical mitigating controls are to avoid opening or playing media from untrusted sources on affected devices, and where the platform allows it, to disable or avoid hardware-accelerated decoding for untrusted content so the crafted bitstream is handled by a software decoder instead - the trade-off being degraded playback performance and battery life for high-resolution video and possible playback failures on formats the software path does not support. Content-filtering or blocking untrusted media delivery at the network boundary can reduce exposure but is easily bypassed by local files, messaging apps and side-loaded content, and none of these controls address the underlying missing bounds check, so patching remains the only complete fix. There is no public exploit code identified at time of analysis, but given that exploitation is network-delivered and only requires the victim to render a crafted file, patch prioritisation should follow normal OEM mobile-update cadence rather than emergency change procedures.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is 'vdec', MediaTek's hardware video-decoder block used across a wide range of smartphone, tablet, Chromebook and IoT SoCs (CPE-scoped via the 25 enumerated chipsets from MT2718 and MT8668 through MT8395 and MT8910). The flaw is classed as CWE-787 (out-of-bounds write) arising from a missing bounds check performed while parsing an incoming video bitstream; when a crafted stream is decoded, the unchecked index/length causes a write past the end of an allocated buffer, producing memory corruption in the decoder context. Per the CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the attack is network-deliverable and needs no privileges, but the attacker gains nothing until the user renders the malicious content (UI:R), at which point confidentiality, integrity and availability are all rated High - consistent with corruption inside a privileged decoder/firmware path on the device. Because vdec sits beneath the application layer in the SoC firmware/media pipeline, successful corruption can plausibly translate into escalation beyond the decoding application, which is why MediaTek classifies this as a remote privilege escalation rather than a simple application crash. EUVD tracks the same issue as EUVD-2026-92208.
Know when Mt6768 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted media is delivered remotely but requires the user to play it (AV:N, UI:R); no auth needed (PR:N); OOB write yields full privilege escalation impact (C/I/A:H).
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9614.
Executive ViewAI
A high-severity out-of-bounds write in MediaTek's video decoder affects numerous system-on-chips (including MT6768, MT6833, MT8186, MT8195, and MT6877), enabling unauthenticated attackers to escalate privileges if a user opens a crafted media file. Although no public exploit code or confirmed active exploitation exists, the broad deployment of these chips across mobile and embedded devices means many organizational endpoints could be at risk. Leadership should prioritize patch deployment when available and reinforce user awareness of untrusted media.
No vendor-released patch identified at time of analysis. Interim mitigations include avoiding opening or playing untrusted media files and monitoring MediaTek's October 2026 product security bulletin for updated guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in MediaTek vdec Out-of-Bounds Write Flaws
View all 2More in Mt6768 Firmware
View allLocal privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrup
Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level p
Local privilege escalation in MediaTek's mtee (MediaTek TEE) allows an attacker who already holds System privilege to ex
Local privilege escalation in MediaTek mtee allows a local attacker who already holds Android System privilege to exploi
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-le
Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, i
A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, produci
Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT
Exploit-DB