EUVD-2026-72194
GHSA-fmxm-vg76-2r5p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconInstall malicious Android app
-
DeliveryApp invokes vdec driver via ioctl
-
ExploitTrigger heap buffer overflow (CWE-122)
-
InstallCorrupt kernel heap structures
-
C2Overwrite kernel code/data pointers
-
ExecuteEscalate to kernel-level code execution
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on the device - specifically, a malicious or compromised Android application running on a device with an affected MediaTek chipset. The vdec (video decoder) kernel driver must be accessible from the app execution context, which is the default configuration for Android media stacks on affected devices. No special Android permissions, no root access, and no user interaction beyond app execution are required (PR:N, UI:N per CVSS). Exploitation is limited to the local device scope (AV:L, S:U) and is not remotely triggerable without a separate prior-stage exploit chain delivering app execution. Per SSVC, the attack is non-automatable, requiring chipset-specific crafting of the malicious driver invocation sequence. Budget and mid-range devices with slower OEM patch cadences represent the highest realistic residual exposure. |
| Impact | The CVSS 8.4 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local, low-complexity, zero-privilege nature of this Android kernel driver attack. PR:N combined with AV:L is characteristic of Android driver vulnerabilities reachable from the app sandbox - any installed app can invoke the driver without elevated permissions, lowering the effective exploitation bar significantly. The breadth of affected chipsets (53 distinct SKUs) across budget-to-flagship device tiers substantially widens the attack surface. SSVC corroborates that no exploitation has been observed and the attack is not automatable (requires tailored interaction with the driver's ioctl interface), mitigating immediate mass-exploitation risk. No CISA KEV listing and no public POC identified at time of analysis. The key risk driver is the large installed base of affected devices whose patch timelines depend on individual OEM update cadences, which are frequently slow for budget Android devices. |
| Exploit ScenarioDerived | An attacker publishes a malicious Android application - disguised as a media player, video utility, or game - that invokes crafted ioctl calls against the vdec kernel driver to trigger the heap buffer overflow. The controlled heap corruption overwrites kernel memory structures, allowing the attacker to escalate from the app sandbox to kernel-level execution. No user interaction beyond app installation is required, granting the attacker full device control including access to credentials, sensors, camera, and persistent persistence mechanisms. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged attacker to escalate privileges to kernel level with full system compromise. The CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that any Android app running on an affected device can trigger this flaw without special permissions or user interaction, consistent with typical Android kernel driver exposure. SSVC rates exploitation as 'none' and the attack as non-automatable, though technical impact is assessed as total; no public exploit or CISA KEV entry exists at time of analysis.
RemediationAI
OEMs shipping devices with affected MediaTek chipsets should integrate the upstream fix under Patch ID ALPS11262030 (Issue MSV-9197) from the MediaTek September 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/September-2026) and issue device security updates promptly. End users should apply the latest Android security patch level from their device manufacturer once available; the patch version provided to OEMs is not independently confirmed as a public release version. As a compensating control pending OEM delivery, enterprise environments should enforce MDM policies restricting sideloading and installation of untrusted applications, and apply app allowlisting where feasible - however, note that any app with default Android permissions on an affected device is a potential exploitation vector, so these controls reduce but do not eliminate risk. No configuration-level workaround exists that disables the vdec driver without breaking media playback functionality.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vdec component is a kernel-level video decoder driver present in MediaTek SoCs and typically exposed as a character device (e.g., /dev/vdec) accessible via ioctl from the Android app sandbox without requiring elevated privileges. CWE-122 (Heap-based Buffer Overflow) indicates that a heap-allocated buffer is written beyond its bounds during video decode operations, leading to controlled kernel memory corruption. The affected chipset family spans the MT6xxx and MT8xxx product lines covering budget through high-end Android SoCs used in smartphones, tablets, and Chromebooks. MediaTek tracks this fix internally as Patch ID ALPS11262030, Issue ID MSV-9197, published in the September 2026 Product Security Bulletin.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local kernel driver reachable from unprivileged app sandbox (AV:L, PR:N); low-complexity heap overflow yields full kernel control (C/I/A:H); scope unchanged as compromise stays within the affected device boundary.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In vdec, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11262030; Issue ID: MSV-9197.
Executive ViewAI
MediaTek's video decoder kernel driver affects 53 popular chipsets found in Android devices and IoT systems, creating an unpatched vulnerability that allows any installed application to gain complete control at the operating system level. Organizations operating Android fleets-enterprise smartphones, tablets, and IoT endpoints-lose the ability to isolate and protect sensitive data, credentials, and network access from compromise. Without a vendor patch, this uncontained risk to system integrity and confidentiality forces a choice between device replacement and indefinite compensating controls.
Mobile device management (MDM) enforcing strict application whitelisting to prevent untrusted app execution; network segmentation isolating affected devices from critical systems and sensitive data repositories; kernel-level anomaly detection and monitoring for privilege-escalation exploits; device replacement prioritization with non-vulnerable chipsets where operationally feasible; continuous subscription to vendor advisories and threat feeds for patch releases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Related Vulnerabilities in MediaTek vdec Heap Buffer Overflow Privilege Escalation
View all 2More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to
Exploit-DB