EUVD-2026-115050
GHSA-mg7h-vxgw-9p69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttain System privilege on device
-
ExploitInvoke vulnerable display code path
-
ExecutionTrigger logic error / stack overflow
-
ImpactSystem crash (local DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold System privilege on the device (CVSS PR:H) and local access (AV:L); it then reaches a flaw in the display subsystem that crashes the system with no user interaction (UI:N). The key limiting factor is this high privilege prerequisite - this is a post-compromise capability, not remotely reachable, and affects only availability (denial of service), with no confidentiality or integrity impact. Affected scope is MediaTek chipsets listed in the EUVD advisory (e.g. MT6985, MT6761, MT6895, MT6989, MT6991, MT8188, among ~30 models); devices on firmware incorporating Patch ID ALPS11410704 from the November 2026 bulletin are not affected. |
| Impact | This is a low-to-moderate priority issue despite the buffer-overflow tagging, and the signals are consistent rather than conflicting. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.4 MEDIUM) describes a local, availability-only flaw that requires the attacker to already hold System privilege (PR:H). SSVC reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis; no EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a defect that should be patched in the normal monthly cycle rather than treated as an incident. The central limiting factor is the PR:H prerequisite: an actor who already possesses System privilege on the device can cause a crash, but gaining nothing in confidentiality or integrity (C:N/I:N) and only triggering a local denial of service. Note a wording mismatch worth awareness: the description attributes the crash to a 'logic error,' while the CWE (CWE-121) and tags label it a stack-based buffer overflow - the precise trigger mechanism is not described in the available sources. |
| Exploit ScenarioDerived | A malicious or compromised component already running with System privilege on an affected MediaTek-based device invokes the vulnerable display code path, triggering a logic error/out-of-bounds condition that crashes the system with no user interaction. No public exploit code has been identified. Because exploitation presupposes System-level privilege, this functions as a post-compromise local denial of service rather than an initial-access vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
A logic error in the display subsystem of MediaTek chipsets can crash the system, producing a local denial of service on affected devices. Exploitation requires the attacker to already hold System privilege (CVSS PR:H) and local access (AV:L), with no user interaction needed; only availability is impacted, with no confidentiality or integrity effect. Approximately 30 chipset models are listed as affected, no public exploit code is identified, and the CISA SSVC assessment rates exploitation as none and automatable as no, placing this at a low-to-moderate priority.
RemediationAI
Apply the vendor fix: MediaTek's November 2026 security bulletin references Patch ID ALPS11410704 (Issue ID MSV-9574), so device builds that incorporate this patch level are not affected; because the fix is delivered at the chipset/firmware level, users should install the OEM firmware update that carries this patch (see https://www.mediatek.com/product-security-bulletin/November-2026 and NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-20590). Until updated firmware is available for a given device, the exposure is limited to attackers who already hold System privilege on the device, so the practical compensating controls are reducing the likelihood of that prerequisite being met: keep privilege-escalation patches current, restrict local access and debugging interfaces, and monitor for anomalous system crashes or reboots that could indicate abuse of a post-compromise denial-of-service capability.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is reported by MediaTek as a logic error in the display component, tagged as a buffer overflow/stack overflow class and mapped to CWE-121 (stack-based buffer overflow), which describes memory corruption on the stack, though the available sources do not detail the exact trigger path or memory-safety mechanism. It resides in the display subsystem of the chipset firmware/software stack, which on Android-class devices runs in a privileged context; the CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) means an attacker who already possesses System privilege and local access can reach the flaw and cause a system crash. Because the privilege requirement is high, this is a post-compromise capability rather than a remotely reachable attack surface, and the CPE data identifies the affected platform broadly as the MediaTek chipset family rather than a single SoC.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Exploitation needs pre-existing System privilege so PR:H, it is local-only (AV:L) with no user interaction, and impact is availability-only (A:H; C:N/I:N).
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In display, there is a possible system crash due to a logic error. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11410704; Issue ID: MSV-9574.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Missing permission checks in the MediaTek GPU pdma driver, paired with a use-after-free, allow local privilege escalatio
Out-of-bounds write in the MediaTek modem component allows code that is already running locally on an affected device to
Local privilege escalation in the GPU pdma path of MediaTek MT8910 and MT6993 chipsets allows an unprivileged local proc
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Local privilege escalation in the MediaTek GPU pdma kernel driver allows a process already running with user-level privi
Exploit-DB