MediaTek TFA Bounds and Permission Vulnerabilities

Out-of-bounds write in MediaTek's Trusted Firmware-A (TFA) component allows a local attacker already holding System-level privilege to crash the device, causing a denial of service. Affected hardware includes MediaTek Dimensity and Helio chipsets MT6986D, MT6986, and MT6982VB. No public exploit code has been identified and CISA KEV does not list this vulnerability, consistent with its low EPSS score of 0.14% and SSVC exploitation status of none.

Information disclosure in the TFA (Trusted Firmware-A) component of MediaTek chipsets allows a local attacker who has already obtained System-level privilege to retrieve sensitive secure-world data without user interaction, due to a missing permission check (CWE-201). The flaw spans 39 distinct MediaTek chipsets across the MT6xxx and MT8xxx families, covering a broad range of Android smartphones, tablets, and embedded devices. No public exploit code or active exploitation has been identified; EPSS stands at 0.14% (4th percentile), consistent with the high privilege prerequisite limiting real-world impact.