EUVD-2026-92195
GHSA-4qxx-g536-wh52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain System privilege on device
-
DeliveryInduce required user interaction
-
ExploitSend malformed data to ccci interface
-
ExecutionTrigger out-of-bounds write (CWE-787)
-
PersistCorrupt memory / leak data
-
ImpactEscalate privileges or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold System privilege on the device (PR:H) and requires local access (AV:L) to the ccci (MediaTek cross-core/modem control) interface - this is a post-compromise privilege-escalation/memory-corruption primitive, not a remote entry point. The description additionally states user interaction is needed, which the vendor CVSS vector (UI:N) omits; treat user interaction as a limiting factor pending vendor clarification. Exploitation is further bounded to the specific affected chipsets (MT6880/MT6890/MT6980D/MT6990/MT6986/MT6986D/MT6813/MT6988/MT2735/MT2737) and is not automatable per SSVC. |
| Impact | This is a genuinely high-severity but low-urgency issue - a 'high CVSS prerequisite' case. The vendor CVSS vector (AV:L/AC:L/PR:H/UI:N, C:H/I:H/A:H, score 6.7) requires the attacker to ALREADY hold System privilege locally, which the description confirms ('if a malicious actor has already obtained the System privilege'). That makes this primarily a privilege-escalation/sandbox-escape primitive rather than an initial-access vulnerability. SSVC reinforces low urgency: Exploitation=none (no observed activity), Automatable=no, though Technical Impact=total (consistent with C:H/I:H/A:H and the CWE-787 out-of-bounds write that can corrupt kernel/modem memory). No EPSS score was provided, and there is no KEV listing and no public POC, so exploitation signals are absent. CONFLICT TO VERIFY: the CVSS vector states UI:N (no user interaction) but the description explicitly says 'User interaction is needed for exploitation' - these disagree; the description's UI requirement further lowers practical risk and should be confirmed with MediaTek. Net: a real but gated local EoP, appropriate for routine patching rather than emergency response. |
| Exploit ScenarioDerived | An attacker who has already compromised a process running with System privilege on an affected MediaTek-chipset device supplies malformed data to the ccci modem/control interface, which lacks a bounds check (CWE-787). With the required user interaction, this triggers an out-of-bounds write/read leading to memory corruption, information disclosure, or escalation beyond System toward kernel-level control. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
An out-of-bounds read/write flaw in MediaTek's ccci (cross-core/modem control) component allows an authenticated local attacker who already holds System privilege to corrupt memory, potentially leading to information disclosure, crashes, or further privilege escalation. Exploitation requires local access and, per the vendor description, user interaction - though the vendor CVSS vector omits UI:R - and is limited to specific MediaTek chipsets (MT6880, MT6890, MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988, MT2735, MT2737). No public exploit code has been identified, SSVC reports exploitation: none and not automatable, making this a high-severity but low-urgency issue due to its high-privilege prerequisite.
RemediationAI
Vendor-released patches are available per chipset: ALPS11428950 for MT6880 and MT6890; ALPS10563453 for MT6980D, MT6990, MT6986, MT6986D, MT6813, and MT6988; and AUTO00858766 for MT2735 and MT2737. Apply these patches through your OEM's firmware update; refer to the MediaTek October 2026 product security bulletin at https://www.mediatek.com/product-security-bulletin/October-2026 for details. Because the vulnerability requires local access and already-held System privilege, standard least-privilege controls and keeping System-level access restricted reduce exposure while patches are being deployed. If immediate patching is not possible, restrict access to the ccci interface via SELinux or similar mandatory access controls, but note this may disrupt modem or cross-core communication functionality; use only as a temporary compensating control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in ccci, a MediaTek driver/interface for cross-core communication between the application processor and modem or other cores. The root cause is a missing bounds check (CWE-787, out-of-bounds write; also out-of-bounds read) that permits memory corruption when specially crafted input is processed. This is a local, post-compromise primitive: the attacker must already possess System privilege (PR:H) and local access (AV:L) to the ccci interface, per the assessed CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, which adds UI:R to reflect the vendor's statement that user interaction is needed. The vendor's original vector uses UI:N, a discrepancy that should be clarified. Affected chipsets are those listed in the MediaTek October 2026 security bulletin: MT6880, MT6890, MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988, MT2735, MT2737. SSVC rates technical impact as total, but exploitation is not automatable and no active exploitation has been observed.
Know when Mt2735 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local ccci interface (AV:L) reachable only by an existing System-privileged actor (PR:H); description requires user interaction (UI:R, diverging from vendor UI:N); OOB write yields full C/I/A impact.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In ccci, there is a possible out of bounds write and read due to a missing bounds check. This could lead to local information disclosure, memory corruption, crashes, or privilege escalation if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS11428950 (Note: For MT6880, MT6890) / ALPS10563453 (Note: For MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988) / AUTO00858766 (Note: For MT2735, MT2737); Issue ID: MSV-9893.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Mt2735 Firmware
View allAn out-of-bounds write in MediaTek modem (baseband) firmware allows an attacker operating a rogue base station to escala
Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an
An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to e
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, i
Denial of service in MediaTek cellular modem firmware lets an attacker running a rogue base station crash the modem of a
A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, produci
Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT
Out-of-bounds read in MediaTek modem firmware (CWE-126) allows an attacker operating a rogue base station to trigger a m
Denial of service against the cellular modem firmware shipped in a very broad range of MediaTek chipsets (MT6739 through
Modem denial of service in MediaTek baseband firmware allows an attacker operating a rogue base station within radio ran
Exploit-DB