MediaTek Audio HAL Buffer Overflow and Race Condition

Heap buffer overflow in MediaTek's Audio Hardware Abstraction Layer (HAL) across six chipset families enables local denial of service on affected mobile and automotive platforms. A local user-level process can trigger an out-of-bounds write in the Audio HAL, crashing the audio subsystem with no user interaction required. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with SSVC's 'none' exploitation status and the strictly local, availability-only impact profile.

Heap buffer overflow in the MediaTek Audio HAL enables a local attacker with user-level privileges to crash the audio subsystem, resulting in a denial of service condition on affected devices. Seven MediaTek chipsets across mobile and automotive platforms are affected, with MediaTek releasing two separate patch IDs addressing the flaw in its August 2026 security bulletin. EPSS at 0.15% (5th percentile), no KEV listing, and a CISA SSVC exploitation status of 'none' collectively indicate negligible real-world exploitation risk at time of analysis; no public exploit code has been identified.

Local denial of service in MediaTek's Audio Hardware Abstraction Layer (HAL) allows a user-privileged process on affected devices to trigger a race condition that renders the system unresponsive. Affected chipsets span two patch families - MT6880/MT6890/MT6988/MT6990 and MT2735/MT2737 - covering a broad range of MediaTek-based mobile and automotive platforms. No active exploitation has been confirmed (not in CISA KEV), and EPSS stands at 0.12% (2nd percentile), reflecting very low real-world exploitation probability at time of analysis.