Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
System privilege prerequisite confirms PR:H; local-only driver access confirms AV:L; no availability impact stated in description justifies A:N.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767.
AnalysisAI
Privilege escalation in MediaTek's AI Processing Unit Subsystem (apusys) driver allows a local attacker already holding System-level privileges on devices equipped with MT8366, MT8196, or MT8195 chipsets to escalate further, achieving high-impact access to confidential data and system integrity. The root cause is a missing bounds check (CWE-749) in an exposed driver function, patched under MediaTek ID AUTO00837766 in the August 2026 security bulletin. No public exploit code has been identified, and the EPSS score of 0.14% (4th percentile) confirms very low current exploitation probability.
Technical ContextAI
The apusys component is MediaTek's AI Processing Unit Subsystem - a kernel-space driver that brokers access to AI/ML hardware accelerators on MediaTek silicon. CWE-749 (Exposed Dangerous Method or Function) indicates that a low-level driver function accepting user-supplied parameters lacks validation of input bounds, creating an exploitable path for controlled memory corruption or unauthorized hardware interaction. The flaw resides specifically in chipsets MT8366, MT8196, and MT8195 (CPE: cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*), which are deployed across Android smartphones, tablets, and Chromebook platforms. The CVSS vector AV:L/PR:H confirms that exploitation requires both local device access and pre-existing System privilege - the level at which privileged Android system services and certain vendor applications operate.
RemediationAI
Apply the patch identified by MediaTek as AUTO00837766 (Issue MSV-6767), available via the August 2026 MediaTek Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Device OEMs using MT8366, MT8196, or MT8195 should integrate this patch into their next security update release and publish a corresponding device-level security bulletin. An exact consumer-facing patched firmware version is not independently confirmed from the provided data - contact your device OEM for version availability. As a compensating control on unpatched devices, restricting the installation of untrusted applications and preventing any non-system-signed code from obtaining System-level privileges reduces exploitation exposure; note this may impact legitimate privileged applications or vendor services relying on System permission grants.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets
Same weakness CWE-749 – Exposed Dangerous Method or Function
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-52057
GHSA-629p-7h2h-8hf5