MediaTek mtee EUVD-2026-92197

Exploitation requires the attacker to already hold the Android System privilege on an affected MediaTek chipset (per CVSS PR:H and the description's 'if a malicious actor has already obtained the System privilege'), after which the vulnerable mtee (MediaTek TEE) code path is reached locally with no user interaction. The out-of-bounds write stems from a missing bounds check in mtee, so the trigger is malformed input passed to that interface. Limiting factors: this is purely local (AV:L) with no remote or network reachability, and the high pre-existing privilege requirement means it is only useful as a second-stage escalation primitive, not an initial-access vector. It affects only MediaTek-based devices using the listed chipsets (e.g., MT8196, MT6768, MT6769, MT6833, MT6877, MT8186, MT8188, MT8195); non-MediaTek platforms are unaffected.

This is a genuine but constrained local privilege-escalation issue, not an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U, 6.7 Medium) is internally consistent with the description: exploitation is local, low-complexity, needs no user interaction, but requires the attacker to ALREADY hold the System privilege (PR:H) - a significant precondition that sharply narrows the realistic attacker population to malicious or already-compromised privileged apps/processes on the device. The payoff is high: full C:H/I:H/A:H impact, consistent with an out-of-bounds write (CWE-787) in mtee (MediaTek's Trusted Execution Environment), effectively crossing from the already-privileged Android world toward the TEE/secure-world trust boundary. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public weaponization. Signals are not conflicting - they consistently point to a high-impact-but-high-barrier local flaw. Priority should be driven by patch management on affected MediaTek-based fleets rather than by emergency incident response.

A malicious or compromised process that has already attained the Android System privilege on a MediaTek-based device invokes the vulnerable mtee interface with crafted input that is not properly bounds-checked, triggering an out-of-bounds write. The resulting memory corruption escalates the attacker's privileges beyond System toward the trusted execution environment, with no user interaction required. No public exploit code was identified in the provided data.