EUVD-2026-52074
GHSA-673r-7q9g-8844
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Local vector required since exploitation demands on-device app execution; PR:N confirmed because the exported component imposes no privilege check on callers; C:H reflects telephony subscriber data sensitivity; no integrity or availability impact.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11086431; Issue ID: MSV-8189.
AnalysisAI
Local information disclosure in the Telephony component across 42 MediaTek chipsets enables any unprivileged application on the device to extract sensitive telephony data without elevated permissions. The root cause is a missing Android permission check (CWE-926: Improper Export of Android Application Components), allowing improperly exported Telephony interfaces to be queried by any installed app. No active exploitation is confirmed - EPSS sits at 0.15% (5th percentile) and the vulnerability is absent from CISA KEV - but the breadth of affected chipsets spanning budget through flagship tiers gives this issue significant deployment reach. Patch ALPS11086431 is available per MediaTek's August 2026 security bulletin.
Technical ContextAI
CWE-926 describes improper export of Android application components - in practice, this means a Content Provider, BroadcastReceiver, Service, or Activity within the Telephony stack is exported in the Android manifest without enforcing a corresponding permission declaration or programmatic permission check. Android's Telephony subsystem manages subscriber identity (IMSI, MSISDN), call state, SMS/MMS metadata, network registration data, and SIM slot information - all sensitive data classes. The CPE string (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) confirms the vulnerability is in MediaTek's proprietary Telephony extensions layered atop AOSP, not in upstream Android itself. The 42 affected chipsets span MediaTek's MT6700 and MT8000 series, covering LTE and 5G SoC families used across consumer Android devices.
RemediationAI
Apply patch ALPS11086431 as documented in MediaTek's August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. Because MediaTek distributes patches to OEM and ODM partners rather than end users directly, affected device manufacturers must integrate this fix into their own security update releases - users should apply the next available OEM security patch for their device. As a compensating control prior to patch availability, organizations managing Android fleets (MDM/EMM deployments) can enforce application allowlisting to prevent untrusted or sideloaded applications from running, which would deny the local execution foothold required for exploitation. Restricting Android Unknown Sources installation and enforcing Google Play Protect narrows the threat surface for consumer devices. There are no known workarounds that address the missing permission check itself without the vendor-supplied patch.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today