Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack path (AV:L) requiring a user account (PR:L); no complexity barriers; full privilege escalation yields complete C/I/A impact on the device.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296.
AnalysisAI
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT7921, MT7922, MT7925, MT7927) due to a missing permission check (CWE-862) that allows a standard user-level process to invoke restricted driver operations. An attacker with low-privilege local access can fully compromise confidentiality, integrity, and availability of the affected system without any user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid low-privilege (standard user) local account on the target system - remote or unauthenticated exploitation is excluded by the AV:L/PR:L CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 HIGH score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the per-device severity: once a low-privilege user is present, exploitation requires no special conditions and yields full system compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a standard (low-privilege) user session on a device equipped with an affected MediaTek chipset - via phishing, credential theft, or a prior low-severity vulnerability - directly invokes a restricted Bluetooth driver interface. Because the driver omits the required permission check, the call succeeds and the attacker's process is elevated to a higher privilege level, enabling access to protected OS resources or persistence mechanisms. … |
| Remediation | Apply the patch identified as WCNCR00488300 (MSV-7296), available through the MediaTek August 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/August-2026). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, begin asset discovery to identify all devices using MediaTek chipsets MT7902, MT7920, MT7921, MT7922, MT7925, or MT7927 across endpoints and network infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets
Local privilege escalation in MediaTek's geniezone hypervisor component affects 36 distinct chipsets spanning budget to
Same weakness CWE-862 – Missing Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-52085
GHSA-854r-9p65-g453