EUVD-2026-40876
GHSA-hq5v-pc42-8w5f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain System privilege via separate exploit
-
DeliveryTarget MediaTek Modem component locally
-
ExploitTrigger permissions bypass (CWE-280)
-
ExecutionEscalate to higher privileged context
-
ImpactAchieve full device confidentiality, integrity, and availability compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V8 - Authorization Insufficient permission handling
|
| Exploitation Conditions | Exploitation requires the attacker to have already obtained System-level privilege on the target Android device running an affected MediaTek chipset - this is explicitly stated in the CVE description and confirmed by the PR:H metric in the CVSS vector (AV:L/AC:L/PR:H/UI:N). The attack is local (AV:L), meaning remote unauthenticated exploitation is not possible; physical or logical local access combined with pre-existing System privilege is mandatory. No user interaction is needed (UI:N), so once System access is held, the escalation step itself is silent. The attack complexity is low (AC:L), indicating no race conditions or special environmental preparation beyond the privilege prerequisite. The primary limiting factor is the requirement for prior System-level compromise, which itself requires a separate exploit chain. The vulnerability is not exploitable in default out-of-the-box device states without prior compromise. |
| Impact | The CVSS 3.1 base score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately characterizes the key limiting factor: an attacker must already possess System-level privilege on the target device before this vulnerability is exploitable. This is a post-compromise escalation primitive, not an initial access vector. In practice, reaching System privilege on Android typically requires exploiting a separate vulnerability chain first, making this a second-stage capability. The full C:H/I:H/A:H impact reflects that once the permissions bypass succeeds, complete confidentiality, integrity, and availability impact follows at the escalated privilege tier. No EPSS data was provided, and neither a CISA KEV listing nor public proof-of-concept code has been identified, keeping real-world exploitation probability low at this time. However, the breadth of affected chipsets - over 80 distinct SKUs across consumer, mid-range, and flagship segments - means the total addressable attack surface is extremely large if paired with a System-level initial access exploit. |
| Exploit ScenarioDerived | An attacker who has already gained System-level code execution on a MediaTek-based Android device - for example, by chaining an application-layer vulnerability with a kernel privilege escalation - targets the Modem component using this permissions bypass to escalate beyond System to a higher-privileged context such as the baseband or trusted execution environment. No user interaction is required once System access is established. No public proof-of-concept code has been identified at time of analysis, meaning this is most likely a component in sophisticated targeted attack chains rather than opportunistic mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System-level access to bypass permission enforcement (CWE-280) and escalate further within the device. The vulnerability is confirmed by MediaTek in their July 2026 Product Security Bulletin (Patch ID: MOLY01716533, Issue ID: MSV-6309) and affects a broad swath of chipsets spanning low-end to flagship tiers. No user interaction is required for exploitation, but the prerequisite of System-level access significantly constrains the realistic attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
MediaTek has released a patch identified as Patch ID MOLY01716533, disclosed in the July 2026 MediaTek Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/July-2026. Device manufacturers (OEMs) must integrate this modem firmware patch into their Android security updates before it reaches end-user devices; the fix does not ship directly from MediaTek to consumers. Affected device owners should apply Android security updates from their OEM as soon as they are made available. Because an exact patched modem firmware version number was not independently confirmed in publicly accessible sources, administrators should verify with the relevant device vendor that the July 2026 MediaTek patch level is incorporated. As a compensating control prior to patch availability, restricting the ability of third-party or sideloaded applications from reaching System privilege (via strict SELinux enforcement, disabling ADB root access, and ensuring bootloader integrity) reduces the likelihood that an attacker can satisfy the prerequisite System-level access required for exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the MediaTek Modem software stack, which runs on dedicated baseband/modem processor firmware present in MediaTek SoCs. The root cause is classified as CWE-280 (Improper Handling of Insufficient Permissions or Privileges), meaning the Modem component fails to correctly validate or enforce permission boundaries when requests arrive from a caller already operating at System privilege - allowing that caller to obtain capabilities beyond what should be granted. This is distinct from a memory corruption or injection flaw; the logic flaw lies in permission-check handling. The CPE string (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) confirms this spans the entire MediaTek chipset product family. Affected chipsets include modems targeting both Android handsets (MT6761, MT6769, MT6785, MT6893, MT6989, MT6993, etc.) and IoT/tablet segments (MT8765, MT8788, MT8893, etc.).
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only vector (AV:L) with high privilege prerequisite (PR:H) matches the System-level access requirement; full C/I/A impact reflects post-escalation control.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01716533; Issue ID: MSV-6309.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in MediaTek Modem Remote DoS and Privilege Escalation
View all 6More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB