Mt8792 Firmware
Monthly
Out-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad set of affected MediaTek SoCs - including MT6768, MT6833, MT8186, MT8195 and MT6877 - when a victim opens or plays attacker-controlled media that reaches the vulnerable decode routine. Exploitation requires no additional execution privileges or authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but does require user interaction, since the crafted stream must actually be rendered by the decoder; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterised as a credible, above-average-priority mobile vulnerability rather than an emergency. MediaTek has assigned patch ID ALPS11383899 (issue MSV-9614) and published guidance in its October 2026 product security bulletin.
An out-of-bounds write in MediaTek modem (baseband) firmware allows an attacker operating a rogue base station to escalate privileges on a wide range of MediaTek chipsets (e.g., MT6853, MT6980, MT6991, MT8798, MT6895) once the victim's device connects to that base station; no authentication is required, but exploitation is high-complexity and requires user interaction per the assessed vector. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is bounded by the need for RF proximity to a malicious base station rather than being a mass-exploitable remote flaw.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an attacker who operates a rogue base station within radio range to escalate privileges on the target device without authentication and without any user interaction. Exploitation is not reachable over the internet: the CVSS vector AV:A/AC:H/PR:N/UI:N with C:H/I:H/A:H reflects that the attacker must be in adjacent radio proximity and must successfully induce the victim's UE to attach to the malicious base station, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a conditionally gated baseband flaw rather than a mass-exploitation emergency. No public exploit code has been identified at time of analysis; MediaTek has released a fix under Patch ID MOLY01778988 (Issue ID MSV-8897) in its October 2026 product security bulletin.
An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to escalate privileges on affected devices once the user equipment attaches to the attacker-controlled cell. The flaw has a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects dozens of MediaTek chipsets, including MT6833, MT6877, MT6983, MT6985, and MT6989, when they run unpatched modem firmware. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, and MediaTek has published a fix under Patch ID MOLY01778993 in its October 2026 product security bulletin.
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level privileges to escalate to kernel-level code execution via a type confusion that leads to an out-of-bounds write. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and no public exploit has been identified at the time of analysis. This is a post-compromise escalation step, not a remote or initial-access vector.
Local privilege escalation in MediaTek's mtee (MediaTek TEE) allows an attacker who already holds System privilege to exploit a missing bounds check, causing an out-of-bounds write that can elevate privileges on affected MediaTek chipsets. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and affects 25 listed MediaTek chipset models including MT8196, MT6768, MT6769, MT6833, MT6877, MT8186, and MT8188. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in MediaTek mtee allows a local attacker who already holds Android System privilege to exploit a CWE-843 type confusion and elevate code execution on affected MediaTek chipsets; user interaction is not required. The flaw is local-only (AV:L) and requires high privileges (PR:H), so it cannot be used for initial access or remote compromise and is primarily useful as a chain component after an attacker has already obtained a System-level foothold. MediaTek has published Patch ID ALPS11383899 in its October 2026 bulletin, and no public exploit identified at time of analysis.
Local privilege escalation in MediaTek's vdec (video decoder) component allows an attacker who already holds System privilege on an affected chipset to supply crafted input that triggers a type-confusion-driven out-of-bounds write, corrupting memory and achieving high confidentiality, integrity, and availability impact at a higher privilege level. The issue affects 24 MediaTek SoCs including MT8395, MT6833, MT6789, MT8195, MT6877, MT8189, MT8391, MT8676, MT8678, MT8793, MT8799, MT6855, MT8367, MT8781, MT8196, MT8910, MT8668, MT8188, MT8792, MT6769, MT6768, MT8186, MT8788E, and MT2718, across mobile, tablet, and embedded platforms. Exploitation is local only, requires the System-privilege prerequisite, and needs no user interaction; the CVSS 3.1 base score is 6.7 (MEDIUM) and no public exploit was identified at time of analysis, so the practical risk is a post-compromise escalation primitive rather than a remote entry point.
Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT6985, MT8195, and others listed in EUVD-2026-92196) and allows an attacker with physical access to the device to trigger an out-of-bounds write due to a missing bounds check, achieving high confidentiality and integrity impact. No authentication, existing execution privileges, or user interaction are required once physical access is obtained. No public exploit has been identified at time of analysis; the physical access prerequisite limits remote exploitation and confines realistic abuse to scenarios such as lost or stolen devices, border inspection, or supply-chain tampering.
Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, including MT6983, MT6895, MT6989, and MT6768, when running unpatched modem firmware. A local app with ordinary low privileges (PR:L) can access sensitive modem debug information without user interaction, yielding high confidentiality impact but no code execution or integrity/availability loss; CVSS is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation, but MediaTek patch MOLY01645293 and the October 2026 product security bulletin address the flaw.
Use-after-free memory corruption in MediaTek's apusys driver allows a local attacker who has already obtained Android System privilege (uid system) to escalate to kernel-level code execution on affected devices, with no user interaction required once that foothold exists. The flaw affects firmware running on a broad set of MediaTek SoCs - including MT6897, MT6899, MT6989, MT6991, MT8196, MT8678 and the other MT-series chipsets listed in MediaTek's October 2026 bulletin - and is addressed by Patch ID ALPS11076799 (Issue ID MSV-8143). Because the CVSS vector carries PR:H and AV:L, this is a second-stage privilege-escalation link that presupposes a prior System-level compromise rather than a standalone remotely reachable bug; no public exploit code or confirmed active exploitation was identified at time of analysis.
A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, producing a remote denial of service on affected handsets. The attack is unauthenticated (CVSS PR:N) and requires no user interaction (UI:N), but it only succeeds if the victim UE is already camped on a rogue base station the attacker controls, which is why the vector is scored AV:A/AC:H and the issue is assessed as moderate severity and low real-world priority. No public exploit code has been identified at the time of analysis, and impact is limited to availability of the modem - no confidentiality or integrity loss, and no code execution. MediaTek has issued a fix under Patch ID MOLY01774038 / Issue ID MSV-8911.
Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT6785, MT6833, MT6883, MT6985, MT6991 and MT8798 - where a missing bounds check during cellular message parsing produces an out-of-bounds read (CWE-126) that can crash the baseband. An attacker who operates a rogue base station and gets a victim UE to attach can trigger the fault with no authentication (PR:N) and no user interaction (UI:N), though the adjacent-network position and specialized radio hardware required drive the high attack complexity (AC:H) and the CVSS 3.1 score of 5.3, with impact limited to availability. Neither our independent assessment nor CISA's SSVC framework records known exploitation (Exploitation: none, Automatable: no), so no public exploit is identified at time of analysis.
Out-of-bounds read in MediaTek modem firmware (CWE-126) allows an attacker operating a rogue base station to trigger a memory over-read in the modem stack of any UE that connects to it, resulting in a remote denial of service (availability only; no data exposure or code execution). The issue affects a very wide set of MediaTek chipsets (MT6989, MT6990, MT6983, MT6768, MT6765 and dozens more) enumerated in MediaTek's October 2026 product security bulletin. No authentication or user interaction is required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.3), but practical exploitation demands radio proximity, rogue base-station infrastructure, and the ability to coerce device attachment - CISA SSVC rates exploitation 'none' and automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine but moderate-priority issue rather than a critical one.
Denial of service against the cellular modem firmware shipped in a very broad range of MediaTek chipsets (MT6739 through MT6993/MT8893 families) arises from an out-of-bounds read caused by a missing permission check. The precondition is that the victim user equipment has already attached to a rogue base station under the attacker's control, meaning the adversary must operate radio infrastructure within range and successfully induce attachment (downgrade or stronger-signal lure) - hence the AV:A/AC:H scoring and the LOW real-world priority despite the enormous chipset footprint. Once attached, exploiting the flaw requires no authentication (PR:N) and no user interaction (UI:N), but the outcome is availability-only (A:H, with no confidentiality or integrity impact); there is confirmed no active exploitation (CISA KEV absent), no public exploit code identified at time of analysis, and no EPSS signal was provided in the source data.
Modem denial of service in MediaTek baseband firmware allows an attacker operating a rogue base station within radio range to crash or reset a victim handset's modem through an out-of-bounds read (CWE-125) caused by an incorrect bounds check on attacker-influenced over-the-air data. The attacker must first get the target UE to camp on the malicious cell (CVSS 3.1 AV:A/AC:H), after which no privileges and no user interaction are required, and the only impact is loss of availability of the modem (A:H, C:N/I:N), yielding a 5.3 base score. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and applicability is limited to devices built on the enumerated MediaTek chipset models with vulnerable modem firmware, so this is a genuine but bounded, proximity-dependent availability risk rather than a mass-exploitation emergency.
Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT6768, MT6853, MT6893, MT6991, MT8186, MT8188 and MT8196) allows an attacker who already holds System privilege to trigger an out-of-bounds write through a missing bounds check, yielding high impact to confidentiality, integrity and availability. No user interaction is required once System access is held, and the flaw is reachable in default configurations of the listed chipsets, making it a post-compromise escalation rather than an initial foothold; the CVSS 6.7 score is dominated by the PR:H prerequisite. A vendor patch is available under MediaTek's October 2026 Product Security Bulletin (patch ID ALPS11276677, issue MSV-9217), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in MediaTek cellular modem firmware lets an attacker running a rogue base station crash the modem of an attached device by delivering a malformed message that triggers a missing bounds check, severing cellular connectivity until the modem restarts. The flaw is availability-only (CVSS 5.3, AV:A/AC:H/PR:N/UI:N/C:N/I:N/A:H) and is gated by radio proximity plus the victim UE actually attaching to the attacker-controlled cell, so it is not reachable over the internet and carries no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and MediaTek has shipped fixes (patch IDs MOLY01864925 / MOLY01210562) covering more than 50 chipsets across the October 2026 product security bulletin.
Denial of service in MediaTek's cellular modem firmware can crash the baseband on a broad set of MediaTek chipsets - including MT6991, MT6988, MT6897, MT8755, MT6835, MT8792 and others - causing the device to drop connectivity or reset. Exploitation is unauthenticated (PR:N, UI:N) but requires the attacker to operate a rogue, attacker-controlled base station and to get the target user equipment to attach to it over the radio interface, which is why attack complexity is rated high (AV:A/AC:H) and impact is limited to availability (A:H; no confidentiality or integrity effect). MediaTek publishes fix identifiers MOLY01870473 / MOLY00814393 (issue MSV-9041) in its October 2026 product security bulletin; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with partial technical impact, keeping real-world priority moderate-to-low despite the large number of affected chipsets.
Out-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad set of affected MediaTek SoCs - including MT6768, MT6833, MT8186, MT8195 and MT6877 - when a victim opens or plays attacker-controlled media that reaches the vulnerable decode routine. Exploitation requires no additional execution privileges or authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but does require user interaction, since the crafted stream must actually be rendered by the decoder; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterised as a credible, above-average-priority mobile vulnerability rather than an emergency. MediaTek has assigned patch ID ALPS11383899 (issue MSV-9614) and published guidance in its October 2026 product security bulletin.
An out-of-bounds write in MediaTek modem (baseband) firmware allows an attacker operating a rogue base station to escalate privileges on a wide range of MediaTek chipsets (e.g., MT6853, MT6980, MT6991, MT8798, MT6895) once the victim's device connects to that base station; no authentication is required, but exploitation is high-complexity and requires user interaction per the assessed vector. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is bounded by the need for RF proximity to a malicious base station rather than being a mass-exploitable remote flaw.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an attacker who operates a rogue base station within radio range to escalate privileges on the target device without authentication and without any user interaction. Exploitation is not reachable over the internet: the CVSS vector AV:A/AC:H/PR:N/UI:N with C:H/I:H/A:H reflects that the attacker must be in adjacent radio proximity and must successfully induce the victim's UE to attach to the malicious base station, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a conditionally gated baseband flaw rather than a mass-exploitation emergency. No public exploit code has been identified at time of analysis; MediaTek has released a fix under Patch ID MOLY01778988 (Issue ID MSV-8897) in its October 2026 product security bulletin.
An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to escalate privileges on affected devices once the user equipment attaches to the attacker-controlled cell. The flaw has a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects dozens of MediaTek chipsets, including MT6833, MT6877, MT6983, MT6985, and MT6989, when they run unpatched modem firmware. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, and MediaTek has published a fix under Patch ID MOLY01778993 in its October 2026 product security bulletin.
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level privileges to escalate to kernel-level code execution via a type confusion that leads to an out-of-bounds write. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and no public exploit has been identified at the time of analysis. This is a post-compromise escalation step, not a remote or initial-access vector.
Local privilege escalation in MediaTek's mtee (MediaTek TEE) allows an attacker who already holds System privilege to exploit a missing bounds check, causing an out-of-bounds write that can elevate privileges on affected MediaTek chipsets. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and affects 25 listed MediaTek chipset models including MT8196, MT6768, MT6769, MT6833, MT6877, MT8186, and MT8188. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in MediaTek mtee allows a local attacker who already holds Android System privilege to exploit a CWE-843 type confusion and elevate code execution on affected MediaTek chipsets; user interaction is not required. The flaw is local-only (AV:L) and requires high privileges (PR:H), so it cannot be used for initial access or remote compromise and is primarily useful as a chain component after an attacker has already obtained a System-level foothold. MediaTek has published Patch ID ALPS11383899 in its October 2026 bulletin, and no public exploit identified at time of analysis.
Local privilege escalation in MediaTek's vdec (video decoder) component allows an attacker who already holds System privilege on an affected chipset to supply crafted input that triggers a type-confusion-driven out-of-bounds write, corrupting memory and achieving high confidentiality, integrity, and availability impact at a higher privilege level. The issue affects 24 MediaTek SoCs including MT8395, MT6833, MT6789, MT8195, MT6877, MT8189, MT8391, MT8676, MT8678, MT8793, MT8799, MT6855, MT8367, MT8781, MT8196, MT8910, MT8668, MT8188, MT8792, MT6769, MT6768, MT8186, MT8788E, and MT2718, across mobile, tablet, and embedded platforms. Exploitation is local only, requires the System-privilege prerequisite, and needs no user interaction; the CVSS 3.1 base score is 6.7 (MEDIUM) and no public exploit was identified at time of analysis, so the practical risk is a post-compromise escalation primitive rather than a remote entry point.
Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT6985, MT8195, and others listed in EUVD-2026-92196) and allows an attacker with physical access to the device to trigger an out-of-bounds write due to a missing bounds check, achieving high confidentiality and integrity impact. No authentication, existing execution privileges, or user interaction are required once physical access is obtained. No public exploit has been identified at time of analysis; the physical access prerequisite limits remote exploitation and confines realistic abuse to scenarios such as lost or stolen devices, border inspection, or supply-chain tampering.
Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, including MT6983, MT6895, MT6989, and MT6768, when running unpatched modem firmware. A local app with ordinary low privileges (PR:L) can access sensitive modem debug information without user interaction, yielding high confidentiality impact but no code execution or integrity/availability loss; CVSS is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation, but MediaTek patch MOLY01645293 and the October 2026 product security bulletin address the flaw.
Use-after-free memory corruption in MediaTek's apusys driver allows a local attacker who has already obtained Android System privilege (uid system) to escalate to kernel-level code execution on affected devices, with no user interaction required once that foothold exists. The flaw affects firmware running on a broad set of MediaTek SoCs - including MT6897, MT6899, MT6989, MT6991, MT8196, MT8678 and the other MT-series chipsets listed in MediaTek's October 2026 bulletin - and is addressed by Patch ID ALPS11076799 (Issue ID MSV-8143). Because the CVSS vector carries PR:H and AV:L, this is a second-stage privilege-escalation link that presupposes a prior System-level compromise rather than a standalone remotely reachable bug; no public exploit code or confirmed active exploitation was identified at time of analysis.
A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, producing a remote denial of service on affected handsets. The attack is unauthenticated (CVSS PR:N) and requires no user interaction (UI:N), but it only succeeds if the victim UE is already camped on a rogue base station the attacker controls, which is why the vector is scored AV:A/AC:H and the issue is assessed as moderate severity and low real-world priority. No public exploit code has been identified at the time of analysis, and impact is limited to availability of the modem - no confidentiality or integrity loss, and no code execution. MediaTek has issued a fix under Patch ID MOLY01774038 / Issue ID MSV-8911.
Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT6785, MT6833, MT6883, MT6985, MT6991 and MT8798 - where a missing bounds check during cellular message parsing produces an out-of-bounds read (CWE-126) that can crash the baseband. An attacker who operates a rogue base station and gets a victim UE to attach can trigger the fault with no authentication (PR:N) and no user interaction (UI:N), though the adjacent-network position and specialized radio hardware required drive the high attack complexity (AC:H) and the CVSS 3.1 score of 5.3, with impact limited to availability. Neither our independent assessment nor CISA's SSVC framework records known exploitation (Exploitation: none, Automatable: no), so no public exploit is identified at time of analysis.
Out-of-bounds read in MediaTek modem firmware (CWE-126) allows an attacker operating a rogue base station to trigger a memory over-read in the modem stack of any UE that connects to it, resulting in a remote denial of service (availability only; no data exposure or code execution). The issue affects a very wide set of MediaTek chipsets (MT6989, MT6990, MT6983, MT6768, MT6765 and dozens more) enumerated in MediaTek's October 2026 product security bulletin. No authentication or user interaction is required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.3), but practical exploitation demands radio proximity, rogue base-station infrastructure, and the ability to coerce device attachment - CISA SSVC rates exploitation 'none' and automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine but moderate-priority issue rather than a critical one.
Denial of service against the cellular modem firmware shipped in a very broad range of MediaTek chipsets (MT6739 through MT6993/MT8893 families) arises from an out-of-bounds read caused by a missing permission check. The precondition is that the victim user equipment has already attached to a rogue base station under the attacker's control, meaning the adversary must operate radio infrastructure within range and successfully induce attachment (downgrade or stronger-signal lure) - hence the AV:A/AC:H scoring and the LOW real-world priority despite the enormous chipset footprint. Once attached, exploiting the flaw requires no authentication (PR:N) and no user interaction (UI:N), but the outcome is availability-only (A:H, with no confidentiality or integrity impact); there is confirmed no active exploitation (CISA KEV absent), no public exploit code identified at time of analysis, and no EPSS signal was provided in the source data.
Modem denial of service in MediaTek baseband firmware allows an attacker operating a rogue base station within radio range to crash or reset a victim handset's modem through an out-of-bounds read (CWE-125) caused by an incorrect bounds check on attacker-influenced over-the-air data. The attacker must first get the target UE to camp on the malicious cell (CVSS 3.1 AV:A/AC:H), after which no privileges and no user interaction are required, and the only impact is loss of availability of the modem (A:H, C:N/I:N), yielding a 5.3 base score. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and applicability is limited to devices built on the enumerated MediaTek chipset models with vulnerable modem firmware, so this is a genuine but bounded, proximity-dependent availability risk rather than a mass-exploitation emergency.
Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT6768, MT6853, MT6893, MT6991, MT8186, MT8188 and MT8196) allows an attacker who already holds System privilege to trigger an out-of-bounds write through a missing bounds check, yielding high impact to confidentiality, integrity and availability. No user interaction is required once System access is held, and the flaw is reachable in default configurations of the listed chipsets, making it a post-compromise escalation rather than an initial foothold; the CVSS 6.7 score is dominated by the PR:H prerequisite. A vendor patch is available under MediaTek's October 2026 Product Security Bulletin (patch ID ALPS11276677, issue MSV-9217), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in MediaTek cellular modem firmware lets an attacker running a rogue base station crash the modem of an attached device by delivering a malformed message that triggers a missing bounds check, severing cellular connectivity until the modem restarts. The flaw is availability-only (CVSS 5.3, AV:A/AC:H/PR:N/UI:N/C:N/I:N/A:H) and is gated by radio proximity plus the victim UE actually attaching to the attacker-controlled cell, so it is not reachable over the internet and carries no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and MediaTek has shipped fixes (patch IDs MOLY01864925 / MOLY01210562) covering more than 50 chipsets across the October 2026 product security bulletin.
Denial of service in MediaTek's cellular modem firmware can crash the baseband on a broad set of MediaTek chipsets - including MT6991, MT6988, MT6897, MT8755, MT6835, MT8792 and others - causing the device to drop connectivity or reset. Exploitation is unauthenticated (PR:N, UI:N) but requires the attacker to operate a rogue, attacker-controlled base station and to get the target user equipment to attach to it over the radio interface, which is why attack complexity is rated high (AV:A/AC:H) and impact is limited to availability (A:H; no confidentiality or integrity effect). MediaTek publishes fix identifiers MOLY01870473 / MOLY00814393 (issue MSV-9041) in its October 2026 product security bulletin; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with partial technical impact, keeping real-world priority moderate-to-low despite the large number of affected chipsets.