Mt8696 Firmware
Monthly
Out-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad set of affected MediaTek SoCs - including MT6768, MT6833, MT8186, MT8195 and MT6877 - when a victim opens or plays attacker-controlled media that reaches the vulnerable decode routine. Exploitation requires no additional execution privileges or authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but does require user interaction, since the crafted stream must actually be rendered by the decoder; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterised as a credible, above-average-priority mobile vulnerability rather than an emergency. MediaTek has assigned patch ID ALPS11383899 (issue MSV-9614) and published guidance in its October 2026 product security bulletin.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an attacker who operates a rogue base station within radio range to escalate privileges on the target device without authentication and without any user interaction. Exploitation is not reachable over the internet: the CVSS vector AV:A/AC:H/PR:N/UI:N with C:H/I:H/A:H reflects that the attacker must be in adjacent radio proximity and must successfully induce the victim's UE to attach to the malicious base station, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a conditionally gated baseband flaw rather than a mass-exploitation emergency. No public exploit code has been identified at time of analysis; MediaTek has released a fix under Patch ID MOLY01778988 (Issue ID MSV-8897) in its October 2026 product security bulletin.
An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to escalate privileges on affected devices once the user equipment attaches to the attacker-controlled cell. The flaw has a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects dozens of MediaTek chipsets, including MT6833, MT6877, MT6983, MT6985, and MT6989, when they run unpatched modem firmware. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, and MediaTek has published a fix under Patch ID MOLY01778993 in its October 2026 product security bulletin.
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level privileges to escalate to kernel-level code execution via a type confusion that leads to an out-of-bounds write. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and no public exploit has been identified at the time of analysis. This is a post-compromise escalation step, not a remote or initial-access vector.
Local privilege escalation in MediaTek's mtee (MediaTek TEE) allows an attacker who already holds System privilege to exploit a missing bounds check, causing an out-of-bounds write that can elevate privileges on affected MediaTek chipsets. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and affects 25 listed MediaTek chipset models including MT8196, MT6768, MT6769, MT6833, MT6877, MT8186, and MT8188. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in MediaTek mtee allows a local attacker who already holds Android System privilege to exploit a CWE-843 type confusion and elevate code execution on affected MediaTek chipsets; user interaction is not required. The flaw is local-only (AV:L) and requires high privileges (PR:H), so it cannot be used for initial access or remote compromise and is primarily useful as a chain component after an attacker has already obtained a System-level foothold. MediaTek has published Patch ID ALPS11383899 in its October 2026 bulletin, and no public exploit identified at time of analysis.
Local privilege escalation in MediaTek's vdec (video decoder) component allows an attacker who already holds System privilege on an affected chipset to supply crafted input that triggers a type-confusion-driven out-of-bounds write, corrupting memory and achieving high confidentiality, integrity, and availability impact at a higher privilege level. The issue affects 24 MediaTek SoCs including MT8395, MT6833, MT6789, MT8195, MT6877, MT8189, MT8391, MT8676, MT8678, MT8793, MT8799, MT6855, MT8367, MT8781, MT8196, MT8910, MT8668, MT8188, MT8792, MT6769, MT6768, MT8186, MT8788E, and MT2718, across mobile, tablet, and embedded platforms. Exploitation is local only, requires the System-privilege prerequisite, and needs no user interaction; the CVSS 3.1 base score is 6.7 (MEDIUM) and no public exploit was identified at time of analysis, so the practical risk is a post-compromise escalation primitive rather than a remote entry point.
Local privilege escalation in the aidl component shipped on a defined set of MediaTek chipsets (MT6899, MT6991, MT8910, MT8781, MT6881, MT8668, MT6989, MT8188, MT6878, MT6993, MT8695, MT8189, MT8696) allows a process that already holds Android System privilege to trigger a use-after-free, corrupt memory, and gain higher-integrity code execution with high confidentiality, integrity, and availability impact. The attack is local (AV:L) and needs no user interaction, but the PR:H prerequisite means it cannot be used for initial access and only functions as a follow-on escalation from an already-compromised privileged context. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS data was not supplied for this CVE. MediaTek has published a fix under Patch ID ALPS11242428 in its October 2026 Product Security Bulletin.
Out-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad set of affected MediaTek SoCs - including MT6768, MT6833, MT8186, MT8195 and MT6877 - when a victim opens or plays attacker-controlled media that reaches the vulnerable decode routine. Exploitation requires no additional execution privileges or authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but does require user interaction, since the crafted stream must actually be rendered by the decoder; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterised as a credible, above-average-priority mobile vulnerability rather than an emergency. MediaTek has assigned patch ID ALPS11383899 (issue MSV-9614) and published guidance in its October 2026 product security bulletin.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an attacker who operates a rogue base station within radio range to escalate privileges on the target device without authentication and without any user interaction. Exploitation is not reachable over the internet: the CVSS vector AV:A/AC:H/PR:N/UI:N with C:H/I:H/A:H reflects that the attacker must be in adjacent radio proximity and must successfully induce the victim's UE to attach to the malicious base station, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a conditionally gated baseband flaw rather than a mass-exploitation emergency. No public exploit code has been identified at time of analysis; MediaTek has released a fix under Patch ID MOLY01778988 (Issue ID MSV-8897) in its October 2026 product security bulletin.
An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to escalate privileges on affected devices once the user equipment attaches to the attacker-controlled cell. The flaw has a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects dozens of MediaTek chipsets, including MT6833, MT6877, MT6983, MT6985, and MT6989, when they run unpatched modem firmware. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, and MediaTek has published a fix under Patch ID MOLY01778993 in its October 2026 product security bulletin.
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level privileges to escalate to kernel-level code execution via a type confusion that leads to an out-of-bounds write. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and no public exploit has been identified at the time of analysis. This is a post-compromise escalation step, not a remote or initial-access vector.
Local privilege escalation in MediaTek's mtee (MediaTek TEE) allows an attacker who already holds System privilege to exploit a missing bounds check, causing an out-of-bounds write that can elevate privileges on affected MediaTek chipsets. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and affects 25 listed MediaTek chipset models including MT8196, MT6768, MT6769, MT6833, MT6877, MT8186, and MT8188. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in MediaTek mtee allows a local attacker who already holds Android System privilege to exploit a CWE-843 type confusion and elevate code execution on affected MediaTek chipsets; user interaction is not required. The flaw is local-only (AV:L) and requires high privileges (PR:H), so it cannot be used for initial access or remote compromise and is primarily useful as a chain component after an attacker has already obtained a System-level foothold. MediaTek has published Patch ID ALPS11383899 in its October 2026 bulletin, and no public exploit identified at time of analysis.
Local privilege escalation in MediaTek's vdec (video decoder) component allows an attacker who already holds System privilege on an affected chipset to supply crafted input that triggers a type-confusion-driven out-of-bounds write, corrupting memory and achieving high confidentiality, integrity, and availability impact at a higher privilege level. The issue affects 24 MediaTek SoCs including MT8395, MT6833, MT6789, MT8195, MT6877, MT8189, MT8391, MT8676, MT8678, MT8793, MT8799, MT6855, MT8367, MT8781, MT8196, MT8910, MT8668, MT8188, MT8792, MT6769, MT6768, MT8186, MT8788E, and MT2718, across mobile, tablet, and embedded platforms. Exploitation is local only, requires the System-privilege prerequisite, and needs no user interaction; the CVSS 3.1 base score is 6.7 (MEDIUM) and no public exploit was identified at time of analysis, so the practical risk is a post-compromise escalation primitive rather than a remote entry point.
Local privilege escalation in the aidl component shipped on a defined set of MediaTek chipsets (MT6899, MT6991, MT8910, MT8781, MT6881, MT8668, MT6989, MT8188, MT6878, MT6993, MT8695, MT8189, MT8696) allows a process that already holds Android System privilege to trigger a use-after-free, corrupt memory, and gain higher-integrity code execution with high confidentiality, integrity, and availability impact. The attack is local (AV:L) and needs no user interaction, but the PR:H prerequisite means it cannot be used for initial access and only functions as a follow-on escalation from an already-compromised privileged context. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS data was not supplied for this CVE. MediaTek has published a fix under Patch ID ALPS11242428 in its October 2026 Product Security Bulletin.