EUVD-2026-52071
GHSA-64x4-mqgf-r965
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Local-only TEE interface exploit requiring System privilege (PR:H); high C and I from secure enclave memory corruption; no availability impact stated.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965373; Issue ID: MSV-6935.
AnalysisAI
Out-of-bounds write in MediaTek's GeniZone Trusted Execution Environment (TEE) component enables local privilege escalation across 14 distinct MediaTek chipsets. An attacker who has already achieved System-level privilege on an affected Android device can exploit a missing bounds check to write outside intended memory boundaries within the secure enclave, gaining confidentiality and integrity access beyond what System privilege normally permits. No public exploit has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability; however, the pre-existing System privilege prerequisite substantially narrows the realistic attack surface.
Technical ContextAI
GeniZone is MediaTek's proprietary implementation of ARM TrustZone, providing an isolated Trusted Execution Environment for handling cryptographic operations, key storage, DRM enforcement, and other security-sensitive tasks on MediaTek SoCs. The vulnerability is rooted in CWE-787 (Out-of-bounds Write): the geniezone driver or TEE interface handler fails to validate buffer indices or sizes before writing to memory, allowing an attacker-controlled value to exceed the intended buffer boundary and corrupt adjacent memory regions. The affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*, spanning 14 chipsets confirmed by EUVD-2026-52071: MT8910, MT8793, MT8798, MT8768, MT8781, MT8755, MT8799, MT8771, MT8796, MT8792, MT8791T, MT8797, MT6989, and MT8775. These are mid-to-high-range SoCs commonly found in Android tablets, smartphones, and embedded devices. The CVSS vector confirms local-only access (AV:L), meaning exploitation cannot be performed over any network interface - it requires code execution already running at System privilege on the device.
RemediationAI
The primary fix is applying Patch ID ALPS10965373 as published in the MediaTek August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. MediaTek distributes patches to OEM/ODM partners; end-user remediation depends on device manufacturers integrating the patch into their firmware update pipeline. Users should apply any available Android security update for their device. No exact user-facing firmware version is confirmed in the available data - the patch version should be verified against the OEM's release notes. In the absence of an OEM patch, compensating controls are limited given that exploitation requires System privilege: hardening System-privilege access by disabling developer options and ADB on production devices reduces the attacker's ability to reach the required privilege level. Restricting sideloaded or untrusted application installation minimizes the likelihood of an app-to-system escalation chain that could precede exploitation of this flaw. These mitigations reduce attack surface but do not eliminate the underlying vulnerability.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today