Mt8695 Firmware
Monthly
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an attacker who operates a rogue base station within radio range to escalate privileges on the target device without authentication and without any user interaction. Exploitation is not reachable over the internet: the CVSS vector AV:A/AC:H/PR:N/UI:N with C:H/I:H/A:H reflects that the attacker must be in adjacent radio proximity and must successfully induce the victim's UE to attach to the malicious base station, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a conditionally gated baseband flaw rather than a mass-exploitation emergency. No public exploit code has been identified at time of analysis; MediaTek has released a fix under Patch ID MOLY01778988 (Issue ID MSV-8897) in its October 2026 product security bulletin.
An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to escalate privileges on affected devices once the user equipment attaches to the attacker-controlled cell. The flaw has a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects dozens of MediaTek chipsets, including MT6833, MT6877, MT6983, MT6985, and MT6989, when they run unpatched modem firmware. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, and MediaTek has published a fix under Patch ID MOLY01778993 in its October 2026 product security bulletin.
Local privilege escalation in the aidl component shipped on a defined set of MediaTek chipsets (MT6899, MT6991, MT8910, MT8781, MT6881, MT8668, MT6989, MT8188, MT6878, MT6993, MT8695, MT8189, MT8696) allows a process that already holds Android System privilege to trigger a use-after-free, corrupt memory, and gain higher-integrity code execution with high confidentiality, integrity, and availability impact. The attack is local (AV:L) and needs no user interaction, but the PR:H prerequisite means it cannot be used for initial access and only functions as a follow-on escalation from an already-compromised privileged context. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS data was not supplied for this CVE. MediaTek has published a fix under Patch ID ALPS11242428 in its October 2026 Product Security Bulletin.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an attacker who operates a rogue base station within radio range to escalate privileges on the target device without authentication and without any user interaction. Exploitation is not reachable over the internet: the CVSS vector AV:A/AC:H/PR:N/UI:N with C:H/I:H/A:H reflects that the attacker must be in adjacent radio proximity and must successfully induce the victim's UE to attach to the malicious base station, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a conditionally gated baseband flaw rather than a mass-exploitation emergency. No public exploit code has been identified at time of analysis; MediaTek has released a fix under Patch ID MOLY01778988 (Issue ID MSV-8897) in its October 2026 product security bulletin.
An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to escalate privileges on affected devices once the user equipment attaches to the attacker-controlled cell. The flaw has a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects dozens of MediaTek chipsets, including MT6833, MT6877, MT6983, MT6985, and MT6989, when they run unpatched modem firmware. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, and MediaTek has published a fix under Patch ID MOLY01778993 in its October 2026 product security bulletin.
Local privilege escalation in the aidl component shipped on a defined set of MediaTek chipsets (MT6899, MT6991, MT8910, MT8781, MT6881, MT8668, MT6989, MT8188, MT6878, MT6993, MT8695, MT8189, MT8696) allows a process that already holds Android System privilege to trigger a use-after-free, corrupt memory, and gain higher-integrity code execution with high confidentiality, integrity, and availability impact. The attack is local (AV:L) and needs no user interaction, but the PR:H prerequisite means it cannot be used for initial access and only functions as a follow-on escalation from an already-compromised privileged context. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS data was not supplied for this CVE. MediaTek has published a fix under Patch ID ALPS11242428 in its October 2026 Product Security Bulletin.