EUVD-2026-52081
GHSA-639g-9ffj-23fc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local user-level access on device
-
DeliveryAccess 'med' driver interface from user space
-
ExploitSubmit crafted input with malformed bounds
-
ExecutionBypass incorrect bounds check
-
PersistTrigger out-of-bounds write into kernel memory
-
ImpactCrash system causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a device running one of the affected MediaTek chipsets (MT6890, MT6988, MT6990, MT2735, or MT2737) with at least user-level execution privileges (PR:L per the CVSS:3.1 vector). The attacker must be able to invoke the 'med' media processing component interface from user space - this is the specific attack surface. No victim user interaction is required once the attacker has local access. Remote unauthenticated exploitation is not possible, as the CVSS AV:L (local) vector confirms the vulnerability cannot be triggered over a network. Exploitation is further limited by the SSVC 'Automatable: no' determination, indicating it cannot be reliably weaponized at scale. |
| Impact | CVSS 5.5 Medium is consistent with the narrow impact profile: local access vector, user-level privileges required, availability-only consequence. EPSS at 0.15% (4th percentile) and SSVC exploitation status of 'none' both independently confirm negligible exploitation activity. This vulnerability is absent from CISA KEV and no POC code is referenced in the bulletin. The SSVC 'Automatable: no' rating further reduces concern about opportunistic mass exploitation. The primary real-world risk is to device stability in scenarios where a malicious or poorly sandboxed application deliberately invokes the vulnerable media driver interface. This is a low-priority patching target except for OEMs shipping devices with active 'med' component exposure to third-party apps. |
| Exploit ScenarioDerived | A local attacker with standard user-level access on an Android device running an affected MediaTek chipset crafts a malformed request targeting the 'med' driver interface, providing input that bypasses the incorrect bounds check and triggers the out-of-bounds write into adjacent kernel memory. The resulting memory corruption causes the kernel to crash or the device to reboot, producing a denial of service. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Out-of-bounds write in the 'med' media processing component of specific MediaTek SoC chipsets (MT6890, MT6988, MT6990, MT2735, MT2737) enables a local attacker with standard user privileges to crash the device, causing a denial of service. The root cause is an incorrect bounds check (CWE-787) that allows a write past allocated buffer boundaries, corrupting memory. No public exploit is identified at time of analysis, and EPSS at 0.15% (4th percentile) combined with SSVC exploitation status of 'none' signals very low real-world exploitation probability.
RemediationAI
Apply vendor-confirmed patches ALPS10981478 (for MT6890, MT6990, MT6988) and AUTO00851173 (for MT2735, MT2737) as documented in the MediaTek August 2026 security bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. OEM device manufacturers must integrate these kernel/firmware patches into their respective software update releases; end-user remediation depends on OEM delivery timelines and device support status. As an interim compensating control, restricting installation of untrusted applications - particularly those invoking media processing APIs - reduces exploitation surface, though this is not a substitute for the patch. There is no known workaround that fully eliminates the vulnerable code path.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the 'med' component - most likely a media codec or processing driver exposed to user space on MediaTek SoC firmware. Affected chipsets are divided across two patch tracks: ALPS10981478 covers the Dimensity-class MT6890, MT6988, and MT6990; AUTO00851173 covers the modem-oriented MT2735 and MT2737. CWE-787 (Out-of-bounds Write) identifies the root cause as writing data beyond the allocated buffer boundary due to missing or incorrect input bounds validation, capable of corrupting adjacent kernel memory structures. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms the flaw is reachable from user space at low complexity, with impact scoped to availability only - no memory disclosure or integrity bypass is indicated.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local vector with user privileges required; impact is availability-only via kernel memory corruption; no confidentiality or integrity consequence described.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981478 (Note: For MT6890, MT6990, MT6988) / AUTO00851173 (Note: For MT2735, MT2737); Issue ID: MSV-7652.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB