EUVD-2026-52066
GHSA-9jxv-qr96-p4v6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain initial foothold on device
-
DeliveryEscalate to System privilege via separate vulnerability
-
ExploitAccess display driver interface
-
InstallCraft malicious display operation without bounds
-
C2Trigger out-of-bounds write in kernel memory
-
ExecuteCorrupt adjacent kernel structures
-
ImpactAchieve elevated kernel-level privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have already obtained System-level privilege on the target device - this is a critical prerequisite that significantly limits the attack surface. System privilege on Android is a high level of access typically reserved for core OS services; an attacker must first compromise the device to this level via a separate vulnerability or social engineering before this flaw becomes relevant. The vulnerability is in the display driver, so the targeted chipset must be one of the ten listed models (MT8910, MT8188, MT8799, MT6991, MT8676, MT6993, MT8678, MT8668, MT8189, MT8781). No user interaction is required once System privilege is held. Exploitation is not automatable (SSVC: Automatable - no) and is not remotely triggerable - local physical or logical access to the device with established System-level execution is required. The CVSS unchanged scope (S:U) indicates the impact remains within the device's own security context. |
| Impact | The vendor-assigned CVSS 6.0 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) accurately reflects a constrained but impactful vulnerability. The critical limiting factor is PR:H - exploitation requires that the attacker already holds System-level privilege on the device, a significant prerequisite that substantially reduces the exploitable population. Despite this, the Technical Impact rating of 'total' in the SSVC framework (Exploitation: none, Automatable: no) acknowledges that once the exploit triggers, the resulting memory corruption has high confidentiality and integrity consequences, consistent with kernel-level memory corruption. EPSS at 0.14% (4th percentile) and absence from CISA KEV confirm no observed exploitation in the wild. The real-world risk is therefore moderate-to-low: this vulnerability would primarily be useful as a second-stage component in a multi-step exploit chain on devices where initial System privilege has already been obtained - such as in sandbox escapes or advanced persistent threat (APT) scenarios. It is not a standalone remote vector. |
| Exploit ScenarioDerived | An attacker who has already established System-level code execution on an Android device - for example, through a separate application-layer vulnerability or malicious system application - targets the display driver by supplying crafted input that triggers the unvalidated buffer write. The resulting out-of-bounds memory corruption overwrites adjacent kernel structures, enabling the attacker to elevate their execution context beyond System privilege, potentially achieving kernel-level code execution or bypassing mandatory access control enforcement. No public proof-of-concept code is known to exist at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Out-of-bounds write in the MediaTek display driver allows a local attacker who has already obtained System-level privilege to further escalate privileges on affected Android devices. The vulnerability stems from a missing bounds check (CWE-787) in display subsystem code across at least ten MediaTek chipsets, including MT8910, MT8188, MT8799, and MT6991 among others. No public exploit or active exploitation (CISA KEV) is identified at time of analysis; EPSS score of 0.14% (4th percentile) and SSVC exploitation rating of 'none' both confirm this remains an undemonstrated threat as of the August 2026 advisory.
RemediationAI
The primary remediation is applying the vendor-released patch referenced as ALPS11009963 in MediaTek's August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Device manufacturers (OEMs) integrating these chipsets must incorporate this patch into their Android security update releases; end users should apply OEM firmware updates as soon as they become available for their specific device models. Because exploitation requires System-level privilege, a compensating control for organizations managing fleets of Android devices is to enforce strict access control policies that prevent unauthorized applications from obtaining System privilege - this can be achieved through enterprise MDM policies, disabling developer options, and enforcing verified boot. Restricting sideloading and app installation from untrusted sources reduces the risk of a malicious application obtaining System privilege in the first place, thereby breaking the exploit chain upstream of this vulnerability. No workaround exists for the display driver flaw itself without the vendor patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the MediaTek display driver - a kernel-space component responsible for managing framebuffer operations and display pipeline interactions on MediaTek SoCs. CWE-787 (Out-of-Bounds Write) indicates the driver writes past the end of an allocated memory buffer due to a missing bounds check, a class of flaw that classically enables memory corruption, control-flow hijacking, and privilege escalation within the kernel. The CPE string cpe:2.3:a:mediatek,_inc.:mediatek_chipset identifies MediaTek's proprietary SoC platform as the affected software layer, running on ARM-based chipsets commonly found in Android mobile and embedded devices. Display drivers interface closely with kernel memory and hardware registers, making OOB write primitives in this subsystem particularly powerful for privilege escalation chains. The patch is tracked internally as ALPS11009963 and MSV-7658, typical of MediaTek's internal patch management system.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Local display driver access requiring pre-obtained System privilege justifies AV:L and PR:H; OOB write enables memory corruption with high C and I impact, but A:N per vendor assessment.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11009963; Issue ID: MSV-7658.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in MediaTek Display Driver Privilege and Disclosure Flaws
View all 6More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB