MediaTek Display Driver Privilege and Disclosure Flaws

Out-of-bounds write in the MediaTek display driver allows a local attacker who has already obtained System-level privilege to further escalate privileges on affected Android devices. The vulnerability stems from a missing bounds check (CWE-787) in display subsystem code across at least ten MediaTek chipsets, including MT8910, MT8188, MT8799, and MT6991 among others. No public exploit or active exploitation (CISA KEV) is identified at time of analysis; EPSS score of 0.14% (4th percentile) and SSVC exploitation rating of 'none' both confirm this remains an undemonstrated threat as of the August 2026 advisory.

Local privilege escalation in the MediaTek display driver allows an attacker who already holds System-level privileges to further escalate via a use-after-free memory corruption condition, potentially achieving kernel-level access. Seventeen MediaTek SoC models used across Android devices are affected, disclosed in MediaTek's August 2026 security bulletin with Patch ID ALPS11019722. No public exploit code exists and EPSS at 0.14% (4th percentile) confirms negligible current exploitation probability; this vulnerability is not in the CISA KEV catalog.

Local privilege escalation in the MediaTek display subsystem affects 17 distinct chipsets including MT6991, MT8768, MT8678, and MT8799, among others. An attacker who has already obtained System-level privilege can exploit a race condition (CWE-367) in the display driver to achieve further privilege escalation, resulting in high confidentiality and integrity impact on the device. No public exploit has been identified at time of analysis, and the EPSS score of 0.11% (2nd percentile) reflects minimal observed exploitation probability; MediaTek has released patch ALPS11019183 via its August 2026 Product Security Bulletin.

Local privilege escalation in MediaTek's display subsystem affects 17 chipset variants used in Android devices, allowing an attacker who has already obtained System-level privilege to exploit a missing bounds check (CWE-787) and write out of bounds in display memory, achieving high confidentiality and integrity impact. The CVSS vector (PR:H/AV:L) confirms this is not an initial-access vector - it is a post-compromise escalation step requiring pre-existing System privilege. No public exploit has been identified, EPSS stands at 0.14% (4th percentile), and the vulnerability is not listed in CISA KEV, consistent with SSVC's exploitation status of 'none.'

Local information disclosure in MediaTek's display subsystem exposes arbitrary kernel memory to a privileged local process due to a missing bounds check (CWE-125). Exploitation is limited to actors who have already obtained System-level privileges on a device running one of 17 affected MediaTek chipsets (MT6991, MT8676, MT8799, and others). No public exploit code and no active exploitation have been identified; EPSS sits at 0.14% (4th percentile), consistent with SSVC's 'none' exploitation status and 'no automatable' classification.

Local information disclosure in the display subsystem of multiple MediaTek SoC chipsets results from a CWE-125 out-of-bounds read triggered by an integer overflow. Seventeen distinct chipsets are confirmed affected per the EUVD listing, spanning devices such as MT8910, MT8188, MT8768, and MT6991 - all prevalent in mid-range and budget Android hardware. Exploitation requires an attacker who has already attained System-level privilege on the device; no public exploit exists and EPSS sits at 0.14% (4th percentile), consistent with the SSVC exploitation rating of 'none'.