EUVD-2026-52058
GHSA-mx6c-568m-63m2
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Local-only attack requiring pre-existing System-level privileges; high C/I from memory corruption enabling further escalation; no availability impact described.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSV-6741.
AnalysisAI
Local privilege escalation in MediaTek's apusys AI Processing Unit subsystem on MT8196 and MT8366 chipsets allows an attacker already holding System-level privileges to further escalate by exploiting a confused deputy flaw - likely realized through an out-of-bounds write (CWE-787) - achieving high confidentiality and integrity impact on the vulnerable system. Disclosed by MediaTek in their August 2026 Product Security Bulletin, a vendor patch is available under Patch ID AUTO00833804. No public exploit has been identified at time of analysis, and an EPSS of 0.14% at the 4th percentile reflects negligible probability of widespread exploitation.
Technical ContextAI
The apusys (AI Processing Unit System) is a MediaTek kernel-level driver subsystem that manages AI and machine learning workloads dispatched to dedicated neural processing hardware embedded in the SoC. A confused deputy vulnerability (CWE-441, though NVD assigns CWE-787) occurs when a privileged kernel component is manipulated by a caller to perform unintended privileged operations on its behalf - in this case, a System-level process abuses the apusys driver to operate beyond its authority. The CWE-787 tag and tags referencing 'Buffer Overflow' and 'Memory Corruption' indicate that the confused deputy interaction is mechanized through an out-of-bounds memory write within the driver, enabling further privilege escalation beyond the System UID. The affected CPE (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) targets MediaTek chipsets broadly, with EUVD-2026-52058 narrowing scope to MT8196 and MT8366 - mid-range SoCs deployed in Android smartphones, tablets, and IoT devices.
RemediationAI
Vendor-released patch is available under Patch ID AUTO00833804 (Issue ID MSV-6741), as disclosed in MediaTek's August 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/August-2026); however, an exact patched BSP or firmware version number is not specified in currently available public references and has not been independently confirmed. OEMs shipping products based on MT8196 and MT8366 should obtain the patched Board Support Package from MediaTek and release updated firmware to end users - end users should apply OEM firmware updates as soon as they are issued. As a compensating control pending OEM delivery, restricting installation of untrusted applications that request System-level privileges and ensuring SELinux is enforced in enforcing mode reduces the attack surface, though these controls only limit the path to obtaining the prerequisite System privilege rather than mitigating the apusys flaw itself.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today