Skip to main content

MediaTek APUSYS EUVDEUVD-2026-52057

| CVE-2026-20467 MEDIUM
Exposed Dangerous Method or Function (CWE-749)
2026-08-03 MediaTek GHSA-629p-7h2h-8hf5
6.0
CVSS 3.1 · Vendor: MediaTek
Share

Severity by source

Vendor (MediaTek) PRIMARY
6.0 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
6.0 MEDIUM

System privilege prerequisite confirms PR:H; local-only driver access confirms AV:L; no availability impact stated in description justifies A:N.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (MediaTek).

CVSS VectorVendor: MediaTek

Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Analysis Generated
Aug 03, 2026 - 20:29 vuln.today
CVSS changed
Aug 03, 2026 - 20:22 NVD
6.0 (MEDIUM)
CVE Published
Aug 03, 2026 - 02:05 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767.

AnalysisAI

Privilege escalation in MediaTek's AI Processing Unit Subsystem (apusys) driver allows a local attacker already holding System-level privileges on devices equipped with MT8366, MT8196, or MT8195 chipsets to escalate further, achieving high-impact access to confidential data and system integrity. The root cause is a missing bounds check (CWE-749) in an exposed driver function, patched under MediaTek ID AUTO00837766 in the August 2026 security bulletin. No public exploit code has been identified, and the EPSS score of 0.14% (4th percentile) confirms very low current exploitation probability.

Technical ContextAI

The apusys component is MediaTek's AI Processing Unit Subsystem - a kernel-space driver that brokers access to AI/ML hardware accelerators on MediaTek silicon. CWE-749 (Exposed Dangerous Method or Function) indicates that a low-level driver function accepting user-supplied parameters lacks validation of input bounds, creating an exploitable path for controlled memory corruption or unauthorized hardware interaction. The flaw resides specifically in chipsets MT8366, MT8196, and MT8195 (CPE: cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*), which are deployed across Android smartphones, tablets, and Chromebook platforms. The CVSS vector AV:L/PR:H confirms that exploitation requires both local device access and pre-existing System privilege - the level at which privileged Android system services and certain vendor applications operate.

RemediationAI

Apply the patch identified by MediaTek as AUTO00837766 (Issue MSV-6767), available via the August 2026 MediaTek Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Device OEMs using MT8366, MT8196, or MT8195 should integrate this patch into their next security update release and publish a corresponding device-level security bulletin. An exact consumer-facing patched firmware version is not independently confirmed from the provided data - contact your device OEM for version availability. As a compensating control on unpatched devices, restricting the installation of untrusted applications and preventing any non-system-signed code from obtaining System-level privileges reduces exploitation exposure; note this may impact legitimate privileged applications or vendor services relying on System permission grants.

CVE-2026-20433 HIGH
8.8 Apr 07

Out-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont

CVE-2026-20465 HIGH
8.1 Aug 03

Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi

CVE-2026-20432 HIGH
8.0 Apr 07

Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con

CVE-2026-20452 HIGH
8.0 Jun 01

Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user

CVE-2026-20495 HIGH
7.8 Aug 03

Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT

CVE-2026-20455 HIGH
7.8 Jun 01

Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain

CVE-2026-20483 HIGH
7.7 Aug 03

Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of

CVE-2026-20479 HIGH
7.5 Aug 03

Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment

CVE-2026-20458 HIGH
7.5 Jul 01

Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a

CVE-2026-20462 MEDIUM
6.7 Jul 01

Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr

CVE-2026-20463 MEDIUM
6.7 Jul 01

Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System

CVE-2026-20486 MEDIUM
6.7 Aug 03

Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets

Share

EUVD-2026-52057 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy