EUVD-2026-92198
GHSA-v3qv-gj82-2cx5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain System privilege on device
-
DeliveryInvoke mtee interface with crafted object
-
ExploitTrigger CWE-843 type confusion
-
ExecutionCorrupt memory for elevated execution
-
ImpactEscalate beyond System privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold the Android System privilege on the device and local code execution to reach the mtee (MediaTek TEE) interface affected by CWE-843 type confusion; no user interaction is needed. The limiting factors are significant: it cannot be triggered remotely and cannot be used for initial access - it only elevates an already-System-level foothold, so it is realistically a chain component. Only the listed MediaTek chipsets (e.g., MT6768, MT6769, MT6833, MT6877, MT8195, MT8196, MT8788E, and ~20 others) running unpatched firmware prior to the October 2026 bulletin are affected. |
| Impact | This is a genuine but relatively contained local privilege-escalation issue, not a high-urgency remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 6.7) is internally consistent with the description: exploitation is local (AV:L), low complexity (AC:L), requires no user interaction (UI:N), but demands high existing privileges (PR:H) - the description explicitly states the attacker must have 'already obtained the System privilege.' This high precondition is the dominant risk-limiting factor and is why a type confusion with full C/I/A=High impact still scores only Medium. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input; there is therefore no signal of active exploitation or public exploit code. The signals do not conflict - they consistently point to a defense-in-depth / sandbox-escape style flaw valuable as the second stage of an exploit chain rather than an initial-access vector. Real priority for devices that can receive the October 2026 MediaTek patch, but not an emergency given the System-privilege prerequisite and absence of any exploitation evidence. |
| Exploit ScenarioDerived | A malicious app or process that has already escalated to the Android System privilege invokes the vulnerable mtee (MediaTek Trusted Execution Environment) interface with crafted input that triggers a type confusion, corrupting memory to gain control beyond the System boundary. Because no user interaction is required, this runs silently as the final privilege-escalation stage of a larger chain. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Local privilege escalation in MediaTek mtee allows a local attacker who already holds Android System privilege to exploit a CWE-843 type confusion and elevate code execution on affected MediaTek chipsets; user interaction is not required. The flaw is local-only (AV:L) and requires high privileges (PR:H), so it cannot be used for initial access or remote compromise and is primarily useful as a chain component after an attacker has already obtained a System-level foothold. MediaTek has published Patch ID ALPS11383899 in its October 2026 bulletin, and no public exploit identified at time of analysis.
RemediationAI
Patch available per vendor advisory. Apply the MediaTek October 2026 Product Security Bulletin firmware update containing Patch ID ALPS11383899 to all affected devices; the advisory is at https://www.mediatek.com/product-security-bulletin/October-2026 and the NVD reference is https://nvd.nist.gov/vuln/detail/CVE-2026-20587. Because exploitation requires an existing Android System privilege and local code execution, prioritize patching devices where privileged local code execution may be exposed and monitor for unexpected use of System-level processes. For devices that cannot be updated immediately, restrict privileged local code execution, limit root or System-level access, and rely on Android verified boot and SELinux to reduce the chance of an attacker reaching the required foothold; these are compensating controls, not fixes. Disabling mtee is not a practical workaround because it would break TEE-backed functions such as key storage, DRM, and other secure services, so the vendor firmware update is the primary remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mtee is the MediaTek trusted execution environment component referenced by the advisory; the vulnerability is a CWE-843 type confusion, meaning the code can be tricked into treating one object type as another, which can corrupt memory and lead to privilege escalation. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms that exploitation is local, has low attack complexity, requires high privileges, needs no user interaction, and can result in high confidentiality, integrity, and availability impact. Per the independent assessment, an attacker must already hold Android System privilege and must achieve local code execution to reach the affected mtee interface; this is not remotely triggerable and cannot provide initial access. EUVD lists the affected chipsets as MT8188, MT8668, MT8391, MT8788E, MT6877, MT6768, MT2718, MT6769, MT8799, MT8195, MT8910, MT8781, MT6833, MT8186, MT6789, MT8792, MT8696, MT8196, MT6855, MT8678, MT8367, MT8676, MT8793, MT8395, and MT8189; no CPE strings were supplied in the source data.
Know when Mt6768 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only TEE flaw requiring pre-existing System privilege gives AV:L and PR:H; no user interaction (UI:N) and type confusion yields full C/I/A high.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In mtee, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9608.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in MediaTek mtee Privilege Escalation Flaws
View all 2More in Mt6768 Firmware
View allOut-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad se
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrup
Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level p
Local privilege escalation in MediaTek's vdec (video decoder) component allows an attacker who already holds System priv
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-le
Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, i
A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, produci
Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT
Exploit-DB