Mt8171 Firmware
Monthly
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT6985, MT8195, and others listed in EUVD-2026-92196) and allows an attacker with physical access to the device to trigger an out-of-bounds write due to a missing bounds check, achieving high confidentiality and integrity impact. No authentication, existing execution privileges, or user interaction are required once physical access is obtained. No public exploit has been identified at time of analysis; the physical access prerequisite limits remote exploitation and confines realistic abuse to scenarios such as lost or stolen devices, border inspection, or supply-chain tampering.
Use-after-free memory corruption in MediaTek's apusys driver allows a local attacker who has already obtained Android System privilege (uid system) to escalate to kernel-level code execution on affected devices, with no user interaction required once that foothold exists. The flaw affects firmware running on a broad set of MediaTek SoCs - including MT6897, MT6899, MT6989, MT6991, MT8196, MT8678 and the other MT-series chipsets listed in MediaTek's October 2026 bulletin - and is addressed by Patch ID ALPS11076799 (Issue ID MSV-8143). Because the CVSS vector carries PR:H and AV:L, this is a second-stage privilege-escalation link that presupposes a prior System-level compromise rather than a standalone remotely reachable bug; no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-level privilege to gain elevated code execution through an integer overflow (CWE-190), with no user interaction required. The flaw affects a broad set of MediaTek chipsets (including MT6893, MT6895, MT6983, MT6991, and MT8188) running unpatched firmware and is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, but MediaTek has published patch ID ALPS11296678 in its October 2026 security bulletin.
Local privilege escalation in the MediaTek display component lets a process that already holds System privilege trigger an out-of-bounds write in a display-path buffer, corrupting memory and potentially escalating to higher-level code execution with high impact to confidentiality, integrity, and availability. The defect is a missing bounds check (CWE-787) reachable without user interaction and with low attack complexity, but only from an existing System-privileged, on-device context (CVSS 3.1 6.7 Medium, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it functions as a second-stage escalation primitive rather than an initial-access or remote vector. Affected hardware spans a broad set of MediaTek chipsets including MT6991, MT6993, MT2718, MT8168-class MT8668/MT8678, MT8171, MT8188, MT8189, MT8196, MT8793, and MT8126; MediaTek has issued Patch ID ALPS11292777 (issue MSV-9195) and no public exploit code has been identified at time of analysis.
Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT6768, MT6853, MT6893, MT6991, MT8186, MT8188 and MT8196) allows an attacker who already holds System privilege to trigger an out-of-bounds write through a missing bounds check, yielding high impact to confidentiality, integrity and availability. No user interaction is required once System access is held, and the flaw is reachable in default configurations of the listed chipsets, making it a post-compromise escalation rather than an initial foothold; the CVSS 6.7 score is dominated by the PR:H prerequisite. A vendor patch is available under MediaTek's October 2026 Product Security Bulletin (patch ID ALPS11276677, issue MSV-9217), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT6985, MT8195, and others listed in EUVD-2026-92196) and allows an attacker with physical access to the device to trigger an out-of-bounds write due to a missing bounds check, achieving high confidentiality and integrity impact. No authentication, existing execution privileges, or user interaction are required once physical access is obtained. No public exploit has been identified at time of analysis; the physical access prerequisite limits remote exploitation and confines realistic abuse to scenarios such as lost or stolen devices, border inspection, or supply-chain tampering.
Use-after-free memory corruption in MediaTek's apusys driver allows a local attacker who has already obtained Android System privilege (uid system) to escalate to kernel-level code execution on affected devices, with no user interaction required once that foothold exists. The flaw affects firmware running on a broad set of MediaTek SoCs - including MT6897, MT6899, MT6989, MT6991, MT8196, MT8678 and the other MT-series chipsets listed in MediaTek's October 2026 bulletin - and is addressed by Patch ID ALPS11076799 (Issue ID MSV-8143). Because the CVSS vector carries PR:H and AV:L, this is a second-stage privilege-escalation link that presupposes a prior System-level compromise rather than a standalone remotely reachable bug; no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-level privilege to gain elevated code execution through an integer overflow (CWE-190), with no user interaction required. The flaw affects a broad set of MediaTek chipsets (including MT6893, MT6895, MT6983, MT6991, and MT8188) running unpatched firmware and is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, but MediaTek has published patch ID ALPS11296678 in its October 2026 security bulletin.
Local privilege escalation in the MediaTek display component lets a process that already holds System privilege trigger an out-of-bounds write in a display-path buffer, corrupting memory and potentially escalating to higher-level code execution with high impact to confidentiality, integrity, and availability. The defect is a missing bounds check (CWE-787) reachable without user interaction and with low attack complexity, but only from an existing System-privileged, on-device context (CVSS 3.1 6.7 Medium, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it functions as a second-stage escalation primitive rather than an initial-access or remote vector. Affected hardware spans a broad set of MediaTek chipsets including MT6991, MT6993, MT2718, MT8168-class MT8668/MT8678, MT8171, MT8188, MT8189, MT8196, MT8793, and MT8126; MediaTek has issued Patch ID ALPS11292777 (issue MSV-9195) and no public exploit code has been identified at time of analysis.
Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT6768, MT6853, MT6893, MT6991, MT8186, MT8188 and MT8196) allows an attacker who already holds System privilege to trigger an out-of-bounds write through a missing bounds check, yielding high impact to confidentiality, integrity and availability. No user interaction is required once System access is held, and the flaw is reachable in default configurations of the listed chipsets, making it a post-compromise escalation rather than an initial foothold; the CVSS 6.7 score is dominated by the PR:H prerequisite. A vendor patch is available under MediaTek's October 2026 Product Security Bulletin (patch ID ALPS11276677, issue MSV-9217), and no public exploit code or confirmed active exploitation has been identified at time of analysis.