Mediatek Chipset
Monthly
Privilege escalation in MediaTek's geniezone component affects ten specific chipset models (MT8792, MT8883, MT8873, MT8893, MT8768, MT8796, MT8799, MT6991, MT8791T, MT8910) due to a missing permission check classified under CWE-1287. An attacker who has already obtained System-level privileges on an affected device can exploit this flaw to escalate further - potentially reaching kernel or TEE-adjacent privilege boundaries - without requiring any user interaction. No public exploit code exists and no active exploitation has been confirmed (EPSS 0.13%, 3rd percentile), positioning this as a chaining vulnerability relevant to targeted attacks rather than opportunistic mass exploitation.
Out-of-bounds read in MediaTek's GeniZone trusted execution environment (TEE) exposes memory on 17 affected chipset models to local information disclosure, but only after an attacker has already acquired System-level privilege. The vulnerability stems from a missing bounds check in the geniezone driver (CWE-125, Patch ID ALPS11036877), and is tracked by MediaTek as MSV-7132. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.14% (4th percentile) and SSVC exploitation status of 'none', this is a low-urgency finding despite the breadth of affected silicon.
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT7921, MT7922, MT7925, MT7927) due to a missing permission check (CWE-862) that allows a standard user-level process to invoke restricted driver operations. An attacker with low-privilege local access can fully compromise confidentiality, integrity, and availability of the affected system without any user interaction. No public exploit identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity.
Out-of-bounds read in the MediaTek Wi-Fi driver component on MT6988, MT6990, and MT6890 chipsets permits local information disclosure against devices where an attacker has already obtained System-level privilege. The missing bounds check in the Wi-Fi stack allows reading memory beyond the intended buffer boundary, exposing potentially sensitive kernel or driver memory contents. No public exploit exists and EPSS at 0.13% (3rd percentile) reflects the significant privilege prerequisite that constrains real-world exploitation; CISA KEV does not list this vulnerability.
Out-of-bounds write in the wifi subsystem of MediaTek MT6890, MT6990, and MT6988 chipsets enables a local denial of service, crashing the wifi component or device. Exploitation requires that the attacker has already obtained System-level privilege on the affected device - an extremely high bar that makes this a post-exploitation nuisance rather than an initial access vector. EPSS sits at 0.13% (3rd percentile), no public exploit code exists, and the vulnerability is not listed in the CISA KEV catalog, all consistent with the substantial privilege prerequisite.
Local denial of service in MediaTek's Audio Hardware Abstraction Layer (HAL) allows a user-privileged process on affected devices to trigger a race condition that renders the system unresponsive. Affected chipsets span two patch families - MT6880/MT6890/MT6988/MT6990 and MT2735/MT2737 - covering a broad range of MediaTek-based mobile and automotive platforms. No active exploitation has been confirmed (not in CISA KEV), and EPSS stands at 0.12% (2nd percentile), reflecting very low real-world exploitation probability at time of analysis.
Out-of-bounds write in the 'med' media processing component of specific MediaTek SoC chipsets (MT6890, MT6988, MT6990, MT2735, MT2737) enables a local attacker with standard user privileges to crash the device, causing a denial of service. The root cause is an incorrect bounds check (CWE-787) that allows a write past allocated buffer boundaries, corrupting memory. No public exploit is identified at time of analysis, and EPSS at 0.15% (4th percentile) combined with SSVC exploitation status of 'none' signals very low real-world exploitation probability.
Out-of-bounds read in MediaTek's ccci (Cross Core Communication Interface) driver on multiple chipsets enables local denial of service by a System-privileged attacker. Affected chipsets include MT6813, MT6988, MT6982VB, MT6986D, and MT6986 - targeting mid-range and flagship Android SoC lines. No public exploit code exists and CISA has not added this to KEV; real-world impact is constrained by the high privilege prerequisite, making this a post-compromise availability risk rather than an initial access vector.
Local information disclosure in the display subsystem of multiple MediaTek SoC chipsets results from a CWE-125 out-of-bounds read triggered by an integer overflow. Seventeen distinct chipsets are confirmed affected per the EUVD listing, spanning devices such as MT8910, MT8188, MT8768, and MT6991 - all prevalent in mid-range and budget Android hardware. Exploitation requires an attacker who has already attained System-level privilege on the device; no public exploit exists and EPSS sits at 0.14% (4th percentile), consistent with the SSVC exploitation rating of 'none'.
Local information disclosure in MediaTek's display subsystem exposes arbitrary kernel memory to a privileged local process due to a missing bounds check (CWE-125). Exploitation is limited to actors who have already obtained System-level privileges on a device running one of 17 affected MediaTek chipsets (MT6991, MT8676, MT8799, and others). No public exploit code and no active exploitation have been identified; EPSS sits at 0.14% (4th percentile), consistent with SSVC's 'none' exploitation status and 'no automatable' classification.
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets allows a local attacker who already holds System-level privilege to crash an application and potentially escalate to a higher privilege tier. Affected chipsets span eleven models including MT8395, MT8799, MT6895, MT6991, and MT8910, covering a broad range of mid-to-high-end Android-targeted SoCs. No public exploit is identified at time of analysis and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation interest, though the post-exploitation utility of this flaw makes it relevant in chained attack scenarios.
Out-of-bounds write in MediaTek's HFRP component on the MT6993 chipset enables local privilege escalation beyond System-level access, confirmed via MediaTek's August 2026 security bulletin. The flaw stems from a missing bounds check (CWE-787), requiring an attacker who has already achieved System privilege to trigger further escalation - a post-compromise lateral movement primitive rather than an initial access vector. No public exploit code and no KEV listing have been identified; EPSS sits at the 3rd percentile, consistent with SSVC's 'exploitation: none' finding.
Information disclosure in the TFA (Trusted Firmware-A) component of MediaTek chipsets allows a local attacker who has already obtained System-level privilege to retrieve sensitive secure-world data without user interaction, due to a missing permission check (CWE-201). The flaw spans 39 distinct MediaTek chipsets across the MT6xxx and MT8xxx families, covering a broad range of Android smartphones, tablets, and embedded devices. No public exploit code or active exploitation has been identified; EPSS stands at 0.14% (4th percentile), consistent with the high privilege prerequisite limiting real-world impact.
Local information disclosure in the Telephony component across 42 MediaTek chipsets enables any unprivileged application on the device to extract sensitive telephony data without elevated permissions. The root cause is a missing Android permission check (CWE-926: Improper Export of Android Application Components), allowing improperly exported Telephony interfaces to be queried by any installed app. No active exploitation is confirmed - EPSS sits at 0.15% (5th percentile) and the vulnerability is absent from CISA KEV - but the breadth of affected chipsets spanning budget through flagship tiers gives this issue significant deployment reach. Patch ALPS11086431 is available per MediaTek's August 2026 security bulletin.
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of its declared Android permissions - to invoke protected telephony operations by exploiting a missing authorization check (CWE-862). The flaw affects 35 MediaTek chipsets spanning the Helio and Dimensity families and yields high confidentiality and integrity impact over telephony functions such as call management and SMS routing. No public exploit has been identified and EPSS of 0.15% (5th percentile) indicates negligible current exploitation activity, though the zero-privilege-required nature of local exploitation lowers the attacker bar once device access is established.
Denial of service in MediaTek WLAN STA (station mode) firmware causes affected devices to become fully unresponsive via uncontrolled logging resource exhaustion (CWE-770). An unauthenticated attacker within wireless proximity can trigger this condition with no user interaction required, targeting chipsets including MT7921, MT7922, MT7902, MT8532, and MT8518S - devices spanning consumer laptops, embedded systems, and IoT hardware. No public exploit or active exploitation has been identified; EPSS of 0.15% (5th percentile) indicates low probabilistic exploitation risk at this time.
Out-of-bounds write in MediaTek's GeniZone Trusted Execution Environment (TEE) component enables local privilege escalation across 14 distinct MediaTek chipsets. An attacker who has already achieved System-level privilege on an affected Android device can exploit a missing bounds check to write outside intended memory boundaries within the secure enclave, gaining confidentiality and integrity access beyond what System privilege normally permits. No public exploit has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability; however, the pre-existing System privilege prerequisite substantially narrows the realistic attack surface.
Out-of-bounds write in MediaTek's GenieZone hypervisor component enables local privilege escalation beyond System-level access on a wide range of MediaTek mobile chipsets. Exploitation is constrained to attackers who have already obtained System privileges, making this a secondary step in a multi-stage attack chain rather than an initial foothold technique. No public exploit code exists and EPSS of 0.13% (3rd percentile) confirms negligible real-world exploitation activity; no CISA KEV listing at time of analysis.
Heap buffer overflow in the MediaTek Audio HAL enables a local attacker with user-level privileges to crash the audio subsystem, resulting in a denial of service condition on affected devices. Seven MediaTek chipsets across mobile and automotive platforms are affected, with MediaTek releasing two separate patch IDs addressing the flaw in its August 2026 security bulletin. EPSS at 0.15% (5th percentile), no KEV listing, and a CISA SSVC exploitation status of 'none' collectively indicate negligible real-world exploitation risk at time of analysis; no public exploit code has been identified.
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment (UE) is connected to an attacker-controlled rogue base station. The flaw stems from a missing bounds check (CWE-125) in modem protocol processing, crashing or disrupting the modem without requiring any user interaction or device-side privileges. No active exploitation is confirmed (no CISA KEV listing), and EPSS probability is very low at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' status - though the attack is classified as automatable once rogue infrastructure is in place.
Heap buffer overflow in MediaTek's Audio Hardware Abstraction Layer (HAL) across six chipset families enables local denial of service on affected mobile and automotive platforms. A local user-level process can trigger an out-of-bounds write in the Audio HAL, crashing the audio subsystem with no user interaction required. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with SSVC's 'none' exploitation status and the strictly local, availability-only impact profile.
Out-of-bounds write in the MediaTek display driver allows a local attacker who has already obtained System-level privilege to further escalate privileges on affected Android devices. The vulnerability stems from a missing bounds check (CWE-787) in display subsystem code across at least ten MediaTek chipsets, including MT8910, MT8188, MT8799, and MT6991 among others. No public exploit or active exploitation (CISA KEV) is identified at time of analysis; EPSS score of 0.14% (4th percentile) and SSVC exploitation rating of 'none' both confirm this remains an undemonstrated threat as of the August 2026 advisory.
Local denial of service in MediaTek's ccci (Cross Core Communication Interface) kernel driver affects MT6986, MT6988, and MT6813 chipsets through a missing bounds check that enables an out-of-bounds memory access. A local user-privileged attacker - such as a malicious Android application - can crash the kernel, causing device unavailability without requiring user interaction. No public exploit code exists and EPSS probability is 0.16% (6th percentile); SSVC exploitation status is confirmed 'none,' aligning all risk signals toward low immediate threat.
Local privilege escalation in MediaTek's display subsystem affects 17 chipset variants used in Android devices, allowing an attacker who has already obtained System-level privilege to exploit a missing bounds check (CWE-787) and write out of bounds in display memory, achieving high confidentiality and integrity impact. The CVSS vector (PR:H/AV:L) confirms this is not an initial-access vector - it is a post-compromise escalation step requiring pre-existing System privilege. No public exploit has been identified, EPSS stands at 0.14% (4th percentile), and the vulnerability is not listed in CISA KEV, consistent with SSVC's exploitation status of 'none.'
Local privilege escalation in the MediaTek display subsystem affects 17 distinct chipsets including MT6991, MT8768, MT8678, and MT8799, among others. An attacker who has already obtained System-level privilege can exploit a race condition (CWE-367) in the display driver to achieve further privilege escalation, resulting in high confidentiality and integrity impact on the device. No public exploit has been identified at time of analysis, and the EPSS score of 0.11% (2nd percentile) reflects minimal observed exploitation probability; MediaTek has released patch ALPS11019183 via its August 2026 Product Security Bulletin.
Local privilege escalation in the MediaTek display driver allows an attacker who already holds System-level privileges to further escalate via a use-after-free memory corruption condition, potentially achieving kernel-level access. Seventeen MediaTek SoC models used across Android devices are affected, disclosed in MediaTek's August 2026 security bulletin with Patch ID ALPS11019722. No public exploit code exists and EPSS at 0.14% (4th percentile) confirms negligible current exploitation probability; this vulnerability is not in the CISA KEV catalog.
Out-of-bounds write in MediaTek's Trusted Firmware-A (TFA) component allows a local attacker already holding System-level privilege to crash the device, causing a denial of service. Affected hardware includes MediaTek Dimensity and Helio chipsets MT6986D, MT6986, and MT6982VB. No public exploit code has been identified and CISA KEV does not list this vulnerability, consistent with its low EPSS score of 0.14% and SSVC exploitation status of none.
Out-of-bounds write in the MediaTek Download Agent (DA) firmware component across eight chipset families allows an attacker with physical device access to trigger a local denial of service by sending a crafted payload while the device is in DA mode. Affected chipsets span mobile SoCs (MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) and modem/automotive chipsets (MT2735, MT2737), broadening the potential device footprint across Android smartphones and connected vehicle platforms. No public exploit code exists, EPSS sits at the 6th percentile (0.16%), SSVC confirms no known exploitation, and the physical access prerequisite fundamentally constrains real-world risk.
Privilege escalation in MediaTek's trusted_mem subsystem affects nine specific chipset models (MT8365, MT8186, MT8188, MT8195, MT8370, MT8371, MT8390, MT8391, MT8395) through a write-what-where condition caused by improper input validation. An attacker who has already obtained System-level privilege can leverage this flaw to escalate further, potentially compromising the trusted memory environment. No public exploit code has been identified and EPSS places exploitation probability at 0.14% (4th percentile), indicating this is currently a low-exploitation-pressure issue despite its local privilege escalation potential.
Local privilege escalation in MediaTek's apusys AI Processing Unit subsystem on MT8196 and MT8366 chipsets allows an attacker already holding System-level privileges to further escalate by exploiting a confused deputy flaw - likely realized through an out-of-bounds write (CWE-787) - achieving high confidentiality and integrity impact on the vulnerable system. Disclosed by MediaTek in their August 2026 Product Security Bulletin, a vendor patch is available under Patch ID AUTO00833804. No public exploit has been identified at time of analysis, and an EPSS of 0.14% at the 4th percentile reflects negligible probability of widespread exploitation.
Privilege escalation in MediaTek's AI Processing Unit Subsystem (apusys) driver allows a local attacker already holding System-level privileges on devices equipped with MT8366, MT8196, or MT8195 chipsets to escalate further, achieving high-impact access to confidential data and system integrity. The root cause is a missing bounds check (CWE-749) in an exposed driver function, patched under MediaTek ID AUTO00837766 in the August 2026 security bulletin. No public exploit code has been identified, and the EPSS score of 0.14% (4th percentile) confirms very low current exploitation probability.
Secure boot heap buffer overflow in MediaTek chipsets MT2737, MT6880, MT6890, and MT6990 enables local privilege escalation by an attacker with physical device access. The vulnerability exists at the pre-OS firmware layer, where a write beyond allocated heap boundaries can corrupt boot verification logic and permit execution of unsigned or attacker-controlled code. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, and the EPSS score of 0.16% (6th percentile) is consistent with the hard physical access prerequisite sharply limiting opportunistic exploitation.
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges without credentials or user interaction on chipsets MT7986, MT7916, MT7915, MT7981, and MT6890. The missing bounds check in the driver's AP-mode frame processing allows memory corruption that yields high confidentiality and integrity impact on the affected device. No public exploit has been identified and EPSS remains very low at 0.17%, though SSVC rates technical impact as total - underscoring the severity if a capable, range-proximate attacker develops working exploit code.
Out-of-bounds write in the MediaTek HEVC video decoder enables further privilege escalation on devices running MT6761, MT8766, and MT8768 chipsets. The flaw, rooted in an integer overflow during HEVC bitstream processing, can be triggered without user interaction but only by an actor who already holds System-level privilege on the device. No public exploit code has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with SSVC's 'Exploitation: none' assessment - though SSVC rates Technical Impact as total, reflecting the severity of what a successful second-stage exploit could achieve.
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System-level access to bypass permission enforcement (CWE-280) and escalate further within the device. The vulnerability is confirmed by MediaTek in their July 2026 Product Security Bulletin (Patch ID: MOLY01716533, Issue ID: MSV-6309) and affects a broad swath of chipsets spanning low-end to flagship tiers. No user interaction is required for exploitation, but the prerequisite of System-level access significantly constrains the realistic attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Android devices, delivering full confidentiality, integrity, and availability impact. Twenty-two specific MediaTek SoC variants are confirmed affected, spanning the MT6xxx and MT8xxx mid-range and budget families. No public exploit has been identified at time of analysis; MediaTek has issued patch ALPS11006447 via their July 2026 security bulletin, but exploitation requires a pre-existing System-level privilege on the device, making this a chaining vulnerability rather than a standalone entry vector.
Out-of-bounds write in MediaTek modem firmware allows a network-adjacent attacker controlling a rogue cellular base station to remotely crash affected User Equipment (UE), resulting in denial of service. Thirty-three distinct MediaTek chipsets - spanning flagship mobile SoCs (MT6991, MT6989, MT6985) to tablet and IoT chipsets (MT8795T, MT8893) - contain the vulnerable modem component identified under Patch IDs MOLY01267281 and MOLY01318201. No public exploit code has been identified at time of analysis, and the attack is non-trivial due to the requirement for attacker-controlled cellular infrastructure, but the sheer deployment scale of affected chipsets across Android devices makes the aggregate exposure significant.
Information disclosure in MediaTek modem firmware across 67+ chipset models enables a network-adjacent attacker operating a rogue cellular base station to extract sensitive data from a victim's User Equipment (UE) without any privileges or user interaction. The root cause is improper input validation (CWE-288) in the modem baseband stack, allowing a fake cell tower to elicit confidential data from connected devices. No active exploitation has been confirmed by CISA KEV, and SSVC assessment rates exploitation as 'none' at time of analysis, though the architecture of the attack closely resembles IMSI-catcher and stingray-type tradecraft used in targeted surveillance operations.
Remote denial-of-service in MediaTek modem firmware across 80+ chipset families allows an attacker operating a rogue cellular base station to crash affected devices by sending malformed input the modem fails to validate. The vulnerability (CWE-288) requires no privileges on the target device and no user interaction - a device that autonomously connects to the attacker's false base station is sufficient. No public exploit code has been identified at time of analysis, and SSVC classifies exploitation status as none, though the widespread chipset deployment across Android handsets and IoT hardware makes the affected attack surface extremely broad.
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a rogue base station to corrupt modem memory via a missing bounds check (out-of-bounds write, CWE-787). Once a target UE camps on the attacker-controlled cell, exploitation requires no user interaction and no pre-existing privileges, potentially yielding privilege escalation within the modem subsystem. Tracked in MediaTek's July 2026 Product Security Bulletin (Patch ID MOLY01402160); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote denial of service in the MediaTek Modem firmware component affects approximately 60 chipset models via a null pointer dereference triggered when a target device connects to a rogue cellular base station. An attacker controlling a fake eNodeB or gNodeB can transmit crafted modem protocol messages that cause improper input validation to fail, crashing the modem and stripping affected devices of cellular connectivity. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation status as none, indicating this remains a theoretical but technically feasible threat for well-resourced actors.
Out-of-bounds write in the MediaTek WLAN STA (Station mode) driver enables local denial of service across six MediaTek Wi-Fi chipset families, confirmed by MediaTek in their June 2026 Product Security Bulletin. A low-privileged local user can crash the system without any user interaction by triggering the missing bounds check in the driver, exploiting CWE-787 memory corruption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gained System-level privileges on an affected device to write out-of-bounds memory and escalate further on the chipset. The flaw affects a broad range of MediaTek chipsets used in mobile and embedded devices, with no public exploit identified at time of analysis. CVSS is 7.8 (High) reflecting the high integrity, confidentiality, and availability impact despite the local attack vector.
Local privilege escalation in MediaTek's GenieZone hypervisor component affects 36 distinct chipsets via a race condition-induced out-of-bounds write. An attacker who has already obtained System-level privilege on an affected Android device can exploit the TOCTOU flaw to escalate further - likely to kernel or hypervisor-level execution - achieving full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the wide chipset footprint spanning flagship to budget SoCs significantly broadens the potential attack surface.
Local privilege escalation in MediaTek's geniezone hypervisor component affects 36 distinct chipsets spanning budget to flagship tiers. An attacker who has already achieved System-level privilege can trigger an out-of-bounds write caused by a missing bounds check, escalating further - likely into kernel or hypervisor trust boundaries - with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and this is not listed in the CISA KEV catalog; however, the post-compromise escalation path makes this relevant to threat actors performing multi-stage device compromise on Android-based MediaTek hardware.
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user execution to corrupt memory and achieve remote code execution without user interaction. The flaw affects multiple MediaTek Wi-Fi chipsets commonly embedded in routers and access points (MT7615, MT7915, MT7916, MT7981, MT7986, MT7990, MT7992, MT7993, MT6890). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Out-of-bounds write in MediaTek's slbc (secure local buffer component) due to type confusion allows local privilege escalation to full system compromise when an attacker already holds System privilege. The vulnerability requires no user interaction and affects 32 MediaTek chipset models. CISA SSVC framework rates technical impact as total; however, EPSS score of 0.02% suggests limited real-world exploitation despite the high CVSS score of 6.7, likely due to the requirement for pre-existing System privilege.
Remote denial of service in MediaTek modem firmware across 47+ chipset variants allows attackers to crash the modem via incorrect error handling when a user equipment device connects to a rogue base station, requiring no authentication or user interaction. The vulnerability affects a broad range of MediaTek cellular chipsets (MT6855, MT6985, MT8793, and others) and carries a CVSS 6.5 score reflecting network-adjacent attack vector and high availability impact. Patch MSV-6100 / MOLY01753620 is available from MediaTek.
Heap buffer overflow in MediaTek modem firmware allows remote denial of service when a device connects to an attacker-controlled base station. The vulnerability affects a wide range of MediaTek chipsets and can crash the modem without requiring user interaction or special privileges. No public exploit code has been identified, and CISA has not listed this in the Known Exploited Vulnerabilities catalog, though the low EPSS score (0.07%) suggests limited real-world exploitation likelihood despite the attack vector requiring only adjacent network access.
Local privilege escalation in MediaTek chipsets (MT6765, MT8893, MT8791T, and 19 others) due to missing permission checks in geniezone allows attackers with System privilege to escalate their access without user interaction. CVSS 6.7 reflects high confidentiality, integrity, and availability impact, but EPSS score of 0.02% (4th percentile) and SSVC 'none' exploitation status indicate this vulnerability has not been observed in active, widespread exploitation despite the low barrier to exploitation from privileged context.
Local privilege escalation in MediaTek geniezone component due to missing bounds check allows System-privileged actors to achieve total system compromise across multiple chipset models. The vulnerability requires prior System-level access and affects 17 MediaTek chipset variants (MT6899, MT8791T, MT8786, MT6789, MT8367, MT6768, MT8766, MT6993, MT6991, MT6877, MT8788E, MT8781, MT8768, MT6989, MT8910, MT8196, MT8793). No public exploit code identified at time of analysis; exploitation remains unconfirmed in active systems despite SSVC indicating total technical impact potential.
Integer overflow in MediaTek secure boot (sec boot) leads to out-of-bounds write causing local denial of service on affected MediaTek chipsets. Attack requires physical device access and local user execution privileges, with no user interaction needed. EPSS score of 0.02% and CISA SSVC assessment of 'none' exploitation status indicate low real-world risk despite the moderate CVSS base score of 4.3.
Out-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-controlled rogue cellular base stations. The vulnerability affects over 60 MediaTek chipset models widely deployed in smartphones and IoT devices, exploitable by adjacent network attackers without authentication (CVSS:3.1 AV:A/PR:N). While EPSS scores this at only 6% exploitation probability (18th percentile) and no active exploitation is confirmed at time of analysis, the attack s
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment connects to an attacker-controlled rogue cellular base station. Affects 57 MediaTek chipset models across MT67xx, MT68xx, MT69xx, MT87xx, and MT27xx families used in mobile devices. Authentication not required (CVSS PR:N) but requires adjacent network access and user interaction to connect to malicious base station. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis, though vendor patch MOLY01406170 has been released per April 2026 MediaTek security bulletin.
Remote denial of service in MediaTek modem chipsets allows unauthenticated attackers to crash the system via a logic error when connecting to a rogue base station. The vulnerability affects 19 MediaTek chipset models (MT8678, MT6899, MT6897, and others) with no authentication or user interaction required. EPSS score of 0.08% (24th percentile) and CISA SSVC framework rating of no confirmed exploitation and partial technical impact suggest this is a low real-world priority despite the moderate CVSS 6.5 score.
Privilege escalation in MediaTek's geniezone component affects ten specific chipset models (MT8792, MT8883, MT8873, MT8893, MT8768, MT8796, MT8799, MT6991, MT8791T, MT8910) due to a missing permission check classified under CWE-1287. An attacker who has already obtained System-level privileges on an affected device can exploit this flaw to escalate further - potentially reaching kernel or TEE-adjacent privilege boundaries - without requiring any user interaction. No public exploit code exists and no active exploitation has been confirmed (EPSS 0.13%, 3rd percentile), positioning this as a chaining vulnerability relevant to targeted attacks rather than opportunistic mass exploitation.
Out-of-bounds read in MediaTek's GeniZone trusted execution environment (TEE) exposes memory on 17 affected chipset models to local information disclosure, but only after an attacker has already acquired System-level privilege. The vulnerability stems from a missing bounds check in the geniezone driver (CWE-125, Patch ID ALPS11036877), and is tracked by MediaTek as MSV-7132. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.14% (4th percentile) and SSVC exploitation status of 'none', this is a low-urgency finding despite the breadth of affected silicon.
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT7921, MT7922, MT7925, MT7927) due to a missing permission check (CWE-862) that allows a standard user-level process to invoke restricted driver operations. An attacker with low-privilege local access can fully compromise confidentiality, integrity, and availability of the affected system without any user interaction. No public exploit identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity.
Out-of-bounds read in the MediaTek Wi-Fi driver component on MT6988, MT6990, and MT6890 chipsets permits local information disclosure against devices where an attacker has already obtained System-level privilege. The missing bounds check in the Wi-Fi stack allows reading memory beyond the intended buffer boundary, exposing potentially sensitive kernel or driver memory contents. No public exploit exists and EPSS at 0.13% (3rd percentile) reflects the significant privilege prerequisite that constrains real-world exploitation; CISA KEV does not list this vulnerability.
Out-of-bounds write in the wifi subsystem of MediaTek MT6890, MT6990, and MT6988 chipsets enables a local denial of service, crashing the wifi component or device. Exploitation requires that the attacker has already obtained System-level privilege on the affected device - an extremely high bar that makes this a post-exploitation nuisance rather than an initial access vector. EPSS sits at 0.13% (3rd percentile), no public exploit code exists, and the vulnerability is not listed in the CISA KEV catalog, all consistent with the substantial privilege prerequisite.
Local denial of service in MediaTek's Audio Hardware Abstraction Layer (HAL) allows a user-privileged process on affected devices to trigger a race condition that renders the system unresponsive. Affected chipsets span two patch families - MT6880/MT6890/MT6988/MT6990 and MT2735/MT2737 - covering a broad range of MediaTek-based mobile and automotive platforms. No active exploitation has been confirmed (not in CISA KEV), and EPSS stands at 0.12% (2nd percentile), reflecting very low real-world exploitation probability at time of analysis.
Out-of-bounds write in the 'med' media processing component of specific MediaTek SoC chipsets (MT6890, MT6988, MT6990, MT2735, MT2737) enables a local attacker with standard user privileges to crash the device, causing a denial of service. The root cause is an incorrect bounds check (CWE-787) that allows a write past allocated buffer boundaries, corrupting memory. No public exploit is identified at time of analysis, and EPSS at 0.15% (4th percentile) combined with SSVC exploitation status of 'none' signals very low real-world exploitation probability.
Out-of-bounds read in MediaTek's ccci (Cross Core Communication Interface) driver on multiple chipsets enables local denial of service by a System-privileged attacker. Affected chipsets include MT6813, MT6988, MT6982VB, MT6986D, and MT6986 - targeting mid-range and flagship Android SoC lines. No public exploit code exists and CISA has not added this to KEV; real-world impact is constrained by the high privilege prerequisite, making this a post-compromise availability risk rather than an initial access vector.
Local information disclosure in the display subsystem of multiple MediaTek SoC chipsets results from a CWE-125 out-of-bounds read triggered by an integer overflow. Seventeen distinct chipsets are confirmed affected per the EUVD listing, spanning devices such as MT8910, MT8188, MT8768, and MT6991 - all prevalent in mid-range and budget Android hardware. Exploitation requires an attacker who has already attained System-level privilege on the device; no public exploit exists and EPSS sits at 0.14% (4th percentile), consistent with the SSVC exploitation rating of 'none'.
Local information disclosure in MediaTek's display subsystem exposes arbitrary kernel memory to a privileged local process due to a missing bounds check (CWE-125). Exploitation is limited to actors who have already obtained System-level privileges on a device running one of 17 affected MediaTek chipsets (MT6991, MT8676, MT8799, and others). No public exploit code and no active exploitation have been identified; EPSS sits at 0.14% (4th percentile), consistent with SSVC's 'none' exploitation status and 'no automatable' classification.
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets allows a local attacker who already holds System-level privilege to crash an application and potentially escalate to a higher privilege tier. Affected chipsets span eleven models including MT8395, MT8799, MT6895, MT6991, and MT8910, covering a broad range of mid-to-high-end Android-targeted SoCs. No public exploit is identified at time of analysis and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation interest, though the post-exploitation utility of this flaw makes it relevant in chained attack scenarios.
Out-of-bounds write in MediaTek's HFRP component on the MT6993 chipset enables local privilege escalation beyond System-level access, confirmed via MediaTek's August 2026 security bulletin. The flaw stems from a missing bounds check (CWE-787), requiring an attacker who has already achieved System privilege to trigger further escalation - a post-compromise lateral movement primitive rather than an initial access vector. No public exploit code and no KEV listing have been identified; EPSS sits at the 3rd percentile, consistent with SSVC's 'exploitation: none' finding.
Information disclosure in the TFA (Trusted Firmware-A) component of MediaTek chipsets allows a local attacker who has already obtained System-level privilege to retrieve sensitive secure-world data without user interaction, due to a missing permission check (CWE-201). The flaw spans 39 distinct MediaTek chipsets across the MT6xxx and MT8xxx families, covering a broad range of Android smartphones, tablets, and embedded devices. No public exploit code or active exploitation has been identified; EPSS stands at 0.14% (4th percentile), consistent with the high privilege prerequisite limiting real-world impact.
Local information disclosure in the Telephony component across 42 MediaTek chipsets enables any unprivileged application on the device to extract sensitive telephony data without elevated permissions. The root cause is a missing Android permission check (CWE-926: Improper Export of Android Application Components), allowing improperly exported Telephony interfaces to be queried by any installed app. No active exploitation is confirmed - EPSS sits at 0.15% (5th percentile) and the vulnerability is absent from CISA KEV - but the breadth of affected chipsets spanning budget through flagship tiers gives this issue significant deployment reach. Patch ALPS11086431 is available per MediaTek's August 2026 security bulletin.
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of its declared Android permissions - to invoke protected telephony operations by exploiting a missing authorization check (CWE-862). The flaw affects 35 MediaTek chipsets spanning the Helio and Dimensity families and yields high confidentiality and integrity impact over telephony functions such as call management and SMS routing. No public exploit has been identified and EPSS of 0.15% (5th percentile) indicates negligible current exploitation activity, though the zero-privilege-required nature of local exploitation lowers the attacker bar once device access is established.
Denial of service in MediaTek WLAN STA (station mode) firmware causes affected devices to become fully unresponsive via uncontrolled logging resource exhaustion (CWE-770). An unauthenticated attacker within wireless proximity can trigger this condition with no user interaction required, targeting chipsets including MT7921, MT7922, MT7902, MT8532, and MT8518S - devices spanning consumer laptops, embedded systems, and IoT hardware. No public exploit or active exploitation has been identified; EPSS of 0.15% (5th percentile) indicates low probabilistic exploitation risk at this time.
Out-of-bounds write in MediaTek's GeniZone Trusted Execution Environment (TEE) component enables local privilege escalation across 14 distinct MediaTek chipsets. An attacker who has already achieved System-level privilege on an affected Android device can exploit a missing bounds check to write outside intended memory boundaries within the secure enclave, gaining confidentiality and integrity access beyond what System privilege normally permits. No public exploit has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability; however, the pre-existing System privilege prerequisite substantially narrows the realistic attack surface.
Out-of-bounds write in MediaTek's GenieZone hypervisor component enables local privilege escalation beyond System-level access on a wide range of MediaTek mobile chipsets. Exploitation is constrained to attackers who have already obtained System privileges, making this a secondary step in a multi-stage attack chain rather than an initial foothold technique. No public exploit code exists and EPSS of 0.13% (3rd percentile) confirms negligible real-world exploitation activity; no CISA KEV listing at time of analysis.
Heap buffer overflow in the MediaTek Audio HAL enables a local attacker with user-level privileges to crash the audio subsystem, resulting in a denial of service condition on affected devices. Seven MediaTek chipsets across mobile and automotive platforms are affected, with MediaTek releasing two separate patch IDs addressing the flaw in its August 2026 security bulletin. EPSS at 0.15% (5th percentile), no KEV listing, and a CISA SSVC exploitation status of 'none' collectively indicate negligible real-world exploitation risk at time of analysis; no public exploit code has been identified.
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment (UE) is connected to an attacker-controlled rogue base station. The flaw stems from a missing bounds check (CWE-125) in modem protocol processing, crashing or disrupting the modem without requiring any user interaction or device-side privileges. No active exploitation is confirmed (no CISA KEV listing), and EPSS probability is very low at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' status - though the attack is classified as automatable once rogue infrastructure is in place.
Heap buffer overflow in MediaTek's Audio Hardware Abstraction Layer (HAL) across six chipset families enables local denial of service on affected mobile and automotive platforms. A local user-level process can trigger an out-of-bounds write in the Audio HAL, crashing the audio subsystem with no user interaction required. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with SSVC's 'none' exploitation status and the strictly local, availability-only impact profile.
Out-of-bounds write in the MediaTek display driver allows a local attacker who has already obtained System-level privilege to further escalate privileges on affected Android devices. The vulnerability stems from a missing bounds check (CWE-787) in display subsystem code across at least ten MediaTek chipsets, including MT8910, MT8188, MT8799, and MT6991 among others. No public exploit or active exploitation (CISA KEV) is identified at time of analysis; EPSS score of 0.14% (4th percentile) and SSVC exploitation rating of 'none' both confirm this remains an undemonstrated threat as of the August 2026 advisory.
Local denial of service in MediaTek's ccci (Cross Core Communication Interface) kernel driver affects MT6986, MT6988, and MT6813 chipsets through a missing bounds check that enables an out-of-bounds memory access. A local user-privileged attacker - such as a malicious Android application - can crash the kernel, causing device unavailability without requiring user interaction. No public exploit code exists and EPSS probability is 0.16% (6th percentile); SSVC exploitation status is confirmed 'none,' aligning all risk signals toward low immediate threat.
Local privilege escalation in MediaTek's display subsystem affects 17 chipset variants used in Android devices, allowing an attacker who has already obtained System-level privilege to exploit a missing bounds check (CWE-787) and write out of bounds in display memory, achieving high confidentiality and integrity impact. The CVSS vector (PR:H/AV:L) confirms this is not an initial-access vector - it is a post-compromise escalation step requiring pre-existing System privilege. No public exploit has been identified, EPSS stands at 0.14% (4th percentile), and the vulnerability is not listed in CISA KEV, consistent with SSVC's exploitation status of 'none.'
Local privilege escalation in the MediaTek display subsystem affects 17 distinct chipsets including MT6991, MT8768, MT8678, and MT8799, among others. An attacker who has already obtained System-level privilege can exploit a race condition (CWE-367) in the display driver to achieve further privilege escalation, resulting in high confidentiality and integrity impact on the device. No public exploit has been identified at time of analysis, and the EPSS score of 0.11% (2nd percentile) reflects minimal observed exploitation probability; MediaTek has released patch ALPS11019183 via its August 2026 Product Security Bulletin.
Local privilege escalation in the MediaTek display driver allows an attacker who already holds System-level privileges to further escalate via a use-after-free memory corruption condition, potentially achieving kernel-level access. Seventeen MediaTek SoC models used across Android devices are affected, disclosed in MediaTek's August 2026 security bulletin with Patch ID ALPS11019722. No public exploit code exists and EPSS at 0.14% (4th percentile) confirms negligible current exploitation probability; this vulnerability is not in the CISA KEV catalog.
Out-of-bounds write in MediaTek's Trusted Firmware-A (TFA) component allows a local attacker already holding System-level privilege to crash the device, causing a denial of service. Affected hardware includes MediaTek Dimensity and Helio chipsets MT6986D, MT6986, and MT6982VB. No public exploit code has been identified and CISA KEV does not list this vulnerability, consistent with its low EPSS score of 0.14% and SSVC exploitation status of none.
Out-of-bounds write in the MediaTek Download Agent (DA) firmware component across eight chipset families allows an attacker with physical device access to trigger a local denial of service by sending a crafted payload while the device is in DA mode. Affected chipsets span mobile SoCs (MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) and modem/automotive chipsets (MT2735, MT2737), broadening the potential device footprint across Android smartphones and connected vehicle platforms. No public exploit code exists, EPSS sits at the 6th percentile (0.16%), SSVC confirms no known exploitation, and the physical access prerequisite fundamentally constrains real-world risk.
Privilege escalation in MediaTek's trusted_mem subsystem affects nine specific chipset models (MT8365, MT8186, MT8188, MT8195, MT8370, MT8371, MT8390, MT8391, MT8395) through a write-what-where condition caused by improper input validation. An attacker who has already obtained System-level privilege can leverage this flaw to escalate further, potentially compromising the trusted memory environment. No public exploit code has been identified and EPSS places exploitation probability at 0.14% (4th percentile), indicating this is currently a low-exploitation-pressure issue despite its local privilege escalation potential.
Local privilege escalation in MediaTek's apusys AI Processing Unit subsystem on MT8196 and MT8366 chipsets allows an attacker already holding System-level privileges to further escalate by exploiting a confused deputy flaw - likely realized through an out-of-bounds write (CWE-787) - achieving high confidentiality and integrity impact on the vulnerable system. Disclosed by MediaTek in their August 2026 Product Security Bulletin, a vendor patch is available under Patch ID AUTO00833804. No public exploit has been identified at time of analysis, and an EPSS of 0.14% at the 4th percentile reflects negligible probability of widespread exploitation.
Privilege escalation in MediaTek's AI Processing Unit Subsystem (apusys) driver allows a local attacker already holding System-level privileges on devices equipped with MT8366, MT8196, or MT8195 chipsets to escalate further, achieving high-impact access to confidential data and system integrity. The root cause is a missing bounds check (CWE-749) in an exposed driver function, patched under MediaTek ID AUTO00837766 in the August 2026 security bulletin. No public exploit code has been identified, and the EPSS score of 0.14% (4th percentile) confirms very low current exploitation probability.
Secure boot heap buffer overflow in MediaTek chipsets MT2737, MT6880, MT6890, and MT6990 enables local privilege escalation by an attacker with physical device access. The vulnerability exists at the pre-OS firmware layer, where a write beyond allocated heap boundaries can corrupt boot verification logic and permit execution of unsigned or attacker-controlled code. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, and the EPSS score of 0.16% (6th percentile) is consistent with the hard physical access prerequisite sharply limiting opportunistic exploitation.
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges without credentials or user interaction on chipsets MT7986, MT7916, MT7915, MT7981, and MT6890. The missing bounds check in the driver's AP-mode frame processing allows memory corruption that yields high confidentiality and integrity impact on the affected device. No public exploit has been identified and EPSS remains very low at 0.17%, though SSVC rates technical impact as total - underscoring the severity if a capable, range-proximate attacker develops working exploit code.
Out-of-bounds write in the MediaTek HEVC video decoder enables further privilege escalation on devices running MT6761, MT8766, and MT8768 chipsets. The flaw, rooted in an integer overflow during HEVC bitstream processing, can be triggered without user interaction but only by an actor who already holds System-level privilege on the device. No public exploit code has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with SSVC's 'Exploitation: none' assessment - though SSVC rates Technical Impact as total, reflecting the severity of what a successful second-stage exploit could achieve.
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System-level access to bypass permission enforcement (CWE-280) and escalate further within the device. The vulnerability is confirmed by MediaTek in their July 2026 Product Security Bulletin (Patch ID: MOLY01716533, Issue ID: MSV-6309) and affects a broad swath of chipsets spanning low-end to flagship tiers. No user interaction is required for exploitation, but the prerequisite of System-level access significantly constrains the realistic attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Android devices, delivering full confidentiality, integrity, and availability impact. Twenty-two specific MediaTek SoC variants are confirmed affected, spanning the MT6xxx and MT8xxx mid-range and budget families. No public exploit has been identified at time of analysis; MediaTek has issued patch ALPS11006447 via their July 2026 security bulletin, but exploitation requires a pre-existing System-level privilege on the device, making this a chaining vulnerability rather than a standalone entry vector.
Out-of-bounds write in MediaTek modem firmware allows a network-adjacent attacker controlling a rogue cellular base station to remotely crash affected User Equipment (UE), resulting in denial of service. Thirty-three distinct MediaTek chipsets - spanning flagship mobile SoCs (MT6991, MT6989, MT6985) to tablet and IoT chipsets (MT8795T, MT8893) - contain the vulnerable modem component identified under Patch IDs MOLY01267281 and MOLY01318201. No public exploit code has been identified at time of analysis, and the attack is non-trivial due to the requirement for attacker-controlled cellular infrastructure, but the sheer deployment scale of affected chipsets across Android devices makes the aggregate exposure significant.
Information disclosure in MediaTek modem firmware across 67+ chipset models enables a network-adjacent attacker operating a rogue cellular base station to extract sensitive data from a victim's User Equipment (UE) without any privileges or user interaction. The root cause is improper input validation (CWE-288) in the modem baseband stack, allowing a fake cell tower to elicit confidential data from connected devices. No active exploitation has been confirmed by CISA KEV, and SSVC assessment rates exploitation as 'none' at time of analysis, though the architecture of the attack closely resembles IMSI-catcher and stingray-type tradecraft used in targeted surveillance operations.
Remote denial-of-service in MediaTek modem firmware across 80+ chipset families allows an attacker operating a rogue cellular base station to crash affected devices by sending malformed input the modem fails to validate. The vulnerability (CWE-288) requires no privileges on the target device and no user interaction - a device that autonomously connects to the attacker's false base station is sufficient. No public exploit code has been identified at time of analysis, and SSVC classifies exploitation status as none, though the widespread chipset deployment across Android handsets and IoT hardware makes the affected attack surface extremely broad.
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a rogue base station to corrupt modem memory via a missing bounds check (out-of-bounds write, CWE-787). Once a target UE camps on the attacker-controlled cell, exploitation requires no user interaction and no pre-existing privileges, potentially yielding privilege escalation within the modem subsystem. Tracked in MediaTek's July 2026 Product Security Bulletin (Patch ID MOLY01402160); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote denial of service in the MediaTek Modem firmware component affects approximately 60 chipset models via a null pointer dereference triggered when a target device connects to a rogue cellular base station. An attacker controlling a fake eNodeB or gNodeB can transmit crafted modem protocol messages that cause improper input validation to fail, crashing the modem and stripping affected devices of cellular connectivity. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation status as none, indicating this remains a theoretical but technically feasible threat for well-resourced actors.
Out-of-bounds write in the MediaTek WLAN STA (Station mode) driver enables local denial of service across six MediaTek Wi-Fi chipset families, confirmed by MediaTek in their June 2026 Product Security Bulletin. A low-privileged local user can crash the system without any user interaction by triggering the missing bounds check in the driver, exploiting CWE-787 memory corruption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gained System-level privileges on an affected device to write out-of-bounds memory and escalate further on the chipset. The flaw affects a broad range of MediaTek chipsets used in mobile and embedded devices, with no public exploit identified at time of analysis. CVSS is 7.8 (High) reflecting the high integrity, confidentiality, and availability impact despite the local attack vector.
Local privilege escalation in MediaTek's GenieZone hypervisor component affects 36 distinct chipsets via a race condition-induced out-of-bounds write. An attacker who has already obtained System-level privilege on an affected Android device can exploit the TOCTOU flaw to escalate further - likely to kernel or hypervisor-level execution - achieving full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the wide chipset footprint spanning flagship to budget SoCs significantly broadens the potential attack surface.
Local privilege escalation in MediaTek's geniezone hypervisor component affects 36 distinct chipsets spanning budget to flagship tiers. An attacker who has already achieved System-level privilege can trigger an out-of-bounds write caused by a missing bounds check, escalating further - likely into kernel or hypervisor trust boundaries - with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and this is not listed in the CISA KEV catalog; however, the post-compromise escalation path makes this relevant to threat actors performing multi-stage device compromise on Android-based MediaTek hardware.
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user execution to corrupt memory and achieve remote code execution without user interaction. The flaw affects multiple MediaTek Wi-Fi chipsets commonly embedded in routers and access points (MT7615, MT7915, MT7916, MT7981, MT7986, MT7990, MT7992, MT7993, MT6890). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Out-of-bounds write in MediaTek's slbc (secure local buffer component) due to type confusion allows local privilege escalation to full system compromise when an attacker already holds System privilege. The vulnerability requires no user interaction and affects 32 MediaTek chipset models. CISA SSVC framework rates technical impact as total; however, EPSS score of 0.02% suggests limited real-world exploitation despite the high CVSS score of 6.7, likely due to the requirement for pre-existing System privilege.
Remote denial of service in MediaTek modem firmware across 47+ chipset variants allows attackers to crash the modem via incorrect error handling when a user equipment device connects to a rogue base station, requiring no authentication or user interaction. The vulnerability affects a broad range of MediaTek cellular chipsets (MT6855, MT6985, MT8793, and others) and carries a CVSS 6.5 score reflecting network-adjacent attack vector and high availability impact. Patch MSV-6100 / MOLY01753620 is available from MediaTek.
Heap buffer overflow in MediaTek modem firmware allows remote denial of service when a device connects to an attacker-controlled base station. The vulnerability affects a wide range of MediaTek chipsets and can crash the modem without requiring user interaction or special privileges. No public exploit code has been identified, and CISA has not listed this in the Known Exploited Vulnerabilities catalog, though the low EPSS score (0.07%) suggests limited real-world exploitation likelihood despite the attack vector requiring only adjacent network access.
Local privilege escalation in MediaTek chipsets (MT6765, MT8893, MT8791T, and 19 others) due to missing permission checks in geniezone allows attackers with System privilege to escalate their access without user interaction. CVSS 6.7 reflects high confidentiality, integrity, and availability impact, but EPSS score of 0.02% (4th percentile) and SSVC 'none' exploitation status indicate this vulnerability has not been observed in active, widespread exploitation despite the low barrier to exploitation from privileged context.
Local privilege escalation in MediaTek geniezone component due to missing bounds check allows System-privileged actors to achieve total system compromise across multiple chipset models. The vulnerability requires prior System-level access and affects 17 MediaTek chipset variants (MT6899, MT8791T, MT8786, MT6789, MT8367, MT6768, MT8766, MT6993, MT6991, MT6877, MT8788E, MT8781, MT8768, MT6989, MT8910, MT8196, MT8793). No public exploit code identified at time of analysis; exploitation remains unconfirmed in active systems despite SSVC indicating total technical impact potential.
Integer overflow in MediaTek secure boot (sec boot) leads to out-of-bounds write causing local denial of service on affected MediaTek chipsets. Attack requires physical device access and local user execution privileges, with no user interaction needed. EPSS score of 0.02% and CISA SSVC assessment of 'none' exploitation status indicate low real-world risk despite the moderate CVSS base score of 4.3.
Out-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-controlled rogue cellular base stations. The vulnerability affects over 60 MediaTek chipset models widely deployed in smartphones and IoT devices, exploitable by adjacent network attackers without authentication (CVSS:3.1 AV:A/PR:N). While EPSS scores this at only 6% exploitation probability (18th percentile) and no active exploitation is confirmed at time of analysis, the attack s
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment connects to an attacker-controlled rogue cellular base station. Affects 57 MediaTek chipset models across MT67xx, MT68xx, MT69xx, MT87xx, and MT27xx families used in mobile devices. Authentication not required (CVSS PR:N) but requires adjacent network access and user interaction to connect to malicious base station. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis, though vendor patch MOLY01406170 has been released per April 2026 MediaTek security bulletin.
Remote denial of service in MediaTek modem chipsets allows unauthenticated attackers to crash the system via a logic error when connecting to a rogue base station. The vulnerability affects 19 MediaTek chipset models (MT8678, MT6899, MT6897, and others) with no authentication or user interaction required. EPSS score of 0.08% (24th percentile) and CISA SSVC framework rating of no confirmed exploitation and partial technical impact suggest this is a low real-world priority despite the moderate CVSS 6.5 score.