EUVD-2026-72209
GHSA-c7c9-9r78-v3mh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain System-level device access
-
DeliveryInteract with geniezone TEE driver
-
ExploitTrigger use-after-free via crafted requests
-
ExecutionReallocate freed memory with attacker content
-
PersistCorrupt kernel/TEE control structures
-
ImpactEscalate to kernel or Secure World privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker already holds System-level privilege on the affected Android device - this is a post-compromise escalation step, not an initial access vector. The device must contain one of the 17 affected MediaTek chipsets (MT6991, MT8755, MT8768, MT8771, MT8775, MT8781, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8799, MT8873, MT8883, MT8893, MT8910). No user interaction is required once System access is achieved. Exploitation is constrained to local (on-device) attack surface - remote exploitation is not possible without a prior remote code execution chain delivering System-level access. The unpatched geniezone driver must be present; devices with the ALPS10900510 patch applied are not affected. |
| Impact | The CVSS 6.7 score (AV:L/AC:L/PR:H/UI:N/S:U) reflects the substantial prerequisite of System-level privilege, which materially limits the attacker pool. In practice, this vulnerability functions as a privilege escalation step in a multi-stage attack chain rather than a standalone entry vector - an adversary must first compromise the Android system partition or obtain adb root/System access through another means before leveraging this flaw. The SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: total) confirms no observed exploitation and highlights that the attack requires non-trivial prerequisites that prevent automation. Despite the high C:H/I:H/A:H impact metrics and 'total' SSVC technical impact, the PR:H prerequisite and AV:L constraint significantly reduce real-world risk compared to a pure-network unauthenticated flaw. There is no CISA KEV listing and no public proof-of-concept. The 'Denial Of Service' tag in the metadata is a secondary/derived label, likely reflecting that memory corruption can crash components; the primary CVE impact is privilege escalation. |
| Exploit ScenarioDerived | An attacker who has already gained System-level access on a target Android device running an affected MediaTek chipset triggers the use-after-free in the geniezone TEE driver by sending a crafted sequence of ioctl or inter-process calls that cause a kernel object to be freed while a reference to it remains accessible. The attacker then reallocates the freed memory with attacker-controlled content, redirecting execution and escalating privileges beyond System to kernel or Secure World level, enabling persistent implantation or credential extraction from the TEE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Local privilege escalation in MediaTek's geniezone Trusted Execution Environment component affects 17 Android chipsets through a use-after-free memory corruption flaw. Exploitation requires an attacker who has already obtained System-level privilege on the device, allowing them to escalate further - potentially to kernel or TEE privilege - with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; the September 2026 MediaTek security bulletin addresses this with Patch ID ALPS10900510.
RemediationAI
Apply the patch distributed through the MediaTek September 2026 Product Security Bulletin (Patch ID: ALPS10900510, Issue ID: MSV-6781), available at https://www.mediatek.com/product-security-bulletin/September-2026. OEM device manufacturers must integrate this patch into their Android security update streams; end users should apply the next available OTA update for their device once their OEM publishes it. Because exploitation requires prior System-level privilege, short-term compensating controls include minimizing adb access, enforcing verified boot (dm-verity), and restricting sideloading or developer mode on managed/enterprise devices. These controls reduce the attacker's ability to achieve the System-privilege prerequisite, indirectly mitigating this flaw. No workaround that disables geniezone functionality without disabling TrustZone entirely is practical, as TEE isolation is a core Android security dependency.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Geniezone is MediaTek's ARM TrustZone-based Trusted Execution Environment (TEE) driver, responsible for mediating interactions between the Android userspace/kernel and the secure world. CWE-416 (use-after-free) occurs when a memory object is accessed after it has been freed, allowing an attacker to manipulate dangling pointer references to redirect execution or corrupt kernel/TEE data structures. Because geniezone operates at the boundary between the Normal World kernel and the Secure World, a UAF in this component can be leveraged to break security isolation guarantees that TrustZone is designed to enforce. Affected CPE: cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*. The 17 affected chipsets span MediaTek's mid-to-high-range Android SoC portfolio (MT6991, MT8755, MT8768, MT8771, MT8775, MT8781, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8799, MT8873, MT8883, MT8893, MT8910), indicating broad product-line impact across the Dimensity/Helio families.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only UAF requiring System privilege (PR:H, AV:L); no scope change despite TEE boundary; full CIA impact from memory corruption escalation.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
DescriptionCVE.org
In geniezone, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10900510; Issue ID: MSV-6781.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek geniezone Privilege Escalation and Info Disclosure
View all 2More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB