Mt8793 Firmware
Monthly
Out-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad set of affected MediaTek SoCs - including MT6768, MT6833, MT8186, MT8195 and MT6877 - when a victim opens or plays attacker-controlled media that reaches the vulnerable decode routine. Exploitation requires no additional execution privileges or authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but does require user interaction, since the crafted stream must actually be rendered by the decoder; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterised as a credible, above-average-priority mobile vulnerability rather than an emergency. MediaTek has assigned patch ID ALPS11383899 (issue MSV-9614) and published guidance in its October 2026 product security bulletin.
Local privilege escalation in the MediaTek APU (AI Processing Unit) driver allows an attacker with existing code execution on affected devices to trigger a use-after-free, achieving full compromise of confidentiality, integrity, and availability (CVSS 8.4). The flaw affects MediaTek chipsets MT8781, MT6993, MT6899, MT8668, MT8910, and MT8793, and requires no additional privileges or user interaction once local access is obtained. No public exploit code or active exploitation is confirmed at time of analysis.
An out-of-bounds write in MediaTek modem (baseband) firmware allows an attacker operating a rogue base station to escalate privileges on a wide range of MediaTek chipsets (e.g., MT6853, MT6980, MT6991, MT8798, MT6895) once the victim's device connects to that base station; no authentication is required, but exploitation is high-complexity and requires user interaction per the assessed vector. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is bounded by the need for RF proximity to a malicious base station rather than being a mass-exploitable remote flaw.
Local privilege escalation in MediaTek's APU (AI Processing Unit) allows a locally-executing attacker to corrupt memory via malformed input, potentially achieving kernel-level code execution on devices with affected chipsets (MT6899, MT8781, MT8910, MT8793, MT6993, MT8668). The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already run code on the device, such as a malicious Android app, with no additional privileges or user interaction needed. No public exploit identified at time of analysis, and the flaw is fixed by MediaTek patch ALPS11249004.
Local privilege escalation in MediaTek NeuroPilot on affected chipsets (MT8781, MT8189, MT6993, MT8793, MT8910, MT8668, MT8188, MT6881, MT8875) allows an attacker with local code execution to trigger an out-of-bounds write in the APU/AI driver, potentially gaining high-integrity code execution with no user interaction, though no additional privileges are needed once that local app context exists. Vendor patch ALPS11249062 is available; no public exploit identified at time of analysis. It is a high-priority patch target for affected MediaTek-based devices but is not remotely reachable, limiting its scope to privilege escalation rather than initial compromise.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an attacker who operates a rogue base station within radio range to escalate privileges on the target device without authentication and without any user interaction. Exploitation is not reachable over the internet: the CVSS vector AV:A/AC:H/PR:N/UI:N with C:H/I:H/A:H reflects that the attacker must be in adjacent radio proximity and must successfully induce the victim's UE to attach to the malicious base station, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a conditionally gated baseband flaw rather than a mass-exploitation emergency. No public exploit code has been identified at time of analysis; MediaTek has released a fix under Patch ID MOLY01778988 (Issue ID MSV-8897) in its October 2026 product security bulletin.
An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to escalate privileges on affected devices once the user equipment attaches to the attacker-controlled cell. The flaw has a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects dozens of MediaTek chipsets, including MT6833, MT6877, MT6983, MT6985, and MT6989, when they run unpatched modem firmware. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, and MediaTek has published a fix under Patch ID MOLY01778993 in its October 2026 product security bulletin.
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level privileges to escalate to kernel-level code execution via a type confusion that leads to an out-of-bounds write. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and no public exploit has been identified at the time of analysis. This is a post-compromise escalation step, not a remote or initial-access vector.
Local privilege escalation in MediaTek's mtee (MediaTek TEE) allows an attacker who already holds System privilege to exploit a missing bounds check, causing an out-of-bounds write that can elevate privileges on affected MediaTek chipsets. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and affects 25 listed MediaTek chipset models including MT8196, MT6768, MT6769, MT6833, MT6877, MT8186, and MT8188. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in MediaTek mtee allows a local attacker who already holds Android System privilege to exploit a CWE-843 type confusion and elevate code execution on affected MediaTek chipsets; user interaction is not required. The flaw is local-only (AV:L) and requires high privileges (PR:H), so it cannot be used for initial access or remote compromise and is primarily useful as a chain component after an attacker has already obtained a System-level foothold. MediaTek has published Patch ID ALPS11383899 in its October 2026 bulletin, and no public exploit identified at time of analysis.
Local privilege escalation in MediaTek's vdec (video decoder) component allows an attacker who already holds System privilege on an affected chipset to supply crafted input that triggers a type-confusion-driven out-of-bounds write, corrupting memory and achieving high confidentiality, integrity, and availability impact at a higher privilege level. The issue affects 24 MediaTek SoCs including MT8395, MT6833, MT6789, MT8195, MT6877, MT8189, MT8391, MT8676, MT8678, MT8793, MT8799, MT6855, MT8367, MT8781, MT8196, MT8910, MT8668, MT8188, MT8792, MT6769, MT6768, MT8186, MT8788E, and MT2718, across mobile, tablet, and embedded platforms. Exploitation is local only, requires the System-privilege prerequisite, and needs no user interaction; the CVSS 3.1 base score is 6.7 (MEDIUM) and no public exploit was identified at time of analysis, so the practical risk is a post-compromise escalation primitive rather than a remote entry point.
Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT6985, MT8195, and others listed in EUVD-2026-92196) and allows an attacker with physical access to the device to trigger an out-of-bounds write due to a missing bounds check, achieving high confidentiality and integrity impact. No authentication, existing execution privileges, or user interaction are required once physical access is obtained. No public exploit has been identified at time of analysis; the physical access prerequisite limits remote exploitation and confines realistic abuse to scenarios such as lost or stolen devices, border inspection, or supply-chain tampering.
Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, including MT6983, MT6895, MT6989, and MT6768, when running unpatched modem firmware. A local app with ordinary low privileges (PR:L) can access sensitive modem debug information without user interaction, yielding high confidentiality impact but no code execution or integrity/availability loss; CVSS is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation, but MediaTek patch MOLY01645293 and the October 2026 product security bulletin address the flaw.
Use-after-free memory corruption in MediaTek's apusys driver allows a local attacker who has already obtained Android System privilege (uid system) to escalate to kernel-level code execution on affected devices, with no user interaction required once that foothold exists. The flaw affects firmware running on a broad set of MediaTek SoCs - including MT6897, MT6899, MT6989, MT6991, MT8196, MT8678 and the other MT-series chipsets listed in MediaTek's October 2026 bulletin - and is addressed by Patch ID ALPS11076799 (Issue ID MSV-8143). Because the CVSS vector carries PR:H and AV:L, this is a second-stage privilege-escalation link that presupposes a prior System-level compromise rather than a standalone remotely reachable bug; no public exploit code or confirmed active exploitation was identified at time of analysis.
A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, producing a remote denial of service on affected handsets. The attack is unauthenticated (CVSS PR:N) and requires no user interaction (UI:N), but it only succeeds if the victim UE is already camped on a rogue base station the attacker controls, which is why the vector is scored AV:A/AC:H and the issue is assessed as moderate severity and low real-world priority. No public exploit code has been identified at the time of analysis, and impact is limited to availability of the modem - no confidentiality or integrity loss, and no code execution. MediaTek has issued a fix under Patch ID MOLY01774038 / Issue ID MSV-8911.
Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT6785, MT6833, MT6883, MT6985, MT6991 and MT8798 - where a missing bounds check during cellular message parsing produces an out-of-bounds read (CWE-126) that can crash the baseband. An attacker who operates a rogue base station and gets a victim UE to attach can trigger the fault with no authentication (PR:N) and no user interaction (UI:N), though the adjacent-network position and specialized radio hardware required drive the high attack complexity (AC:H) and the CVSS 3.1 score of 5.3, with impact limited to availability. Neither our independent assessment nor CISA's SSVC framework records known exploitation (Exploitation: none, Automatable: no), so no public exploit is identified at time of analysis.
Out-of-bounds read in MediaTek modem firmware (CWE-126) allows an attacker operating a rogue base station to trigger a memory over-read in the modem stack of any UE that connects to it, resulting in a remote denial of service (availability only; no data exposure or code execution). The issue affects a very wide set of MediaTek chipsets (MT6989, MT6990, MT6983, MT6768, MT6765 and dozens more) enumerated in MediaTek's October 2026 product security bulletin. No authentication or user interaction is required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.3), but practical exploitation demands radio proximity, rogue base-station infrastructure, and the ability to coerce device attachment - CISA SSVC rates exploitation 'none' and automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine but moderate-priority issue rather than a critical one.
Denial of service against the cellular modem firmware shipped in a very broad range of MediaTek chipsets (MT6739 through MT6993/MT8893 families) arises from an out-of-bounds read caused by a missing permission check. The precondition is that the victim user equipment has already attached to a rogue base station under the attacker's control, meaning the adversary must operate radio infrastructure within range and successfully induce attachment (downgrade or stronger-signal lure) - hence the AV:A/AC:H scoring and the LOW real-world priority despite the enormous chipset footprint. Once attached, exploiting the flaw requires no authentication (PR:N) and no user interaction (UI:N), but the outcome is availability-only (A:H, with no confidentiality or integrity impact); there is confirmed no active exploitation (CISA KEV absent), no public exploit code identified at time of analysis, and no EPSS signal was provided in the source data.
A missing permission check in the MediaTek AIDL (Android Interface Definition Language) component allows an attacker who already holds the Android System privilege to escalate to higher privileges locally, with no user interaction required. The expected impact is high across confidentiality, integrity, and availability (CVSS 3.1 base 6.7, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but the local-only vector and the PR:H precondition mean an ordinary unprivileged app cannot trigger it directly - it is only useful as a second-stage step in an existing exploit chain or for already-privileged malware. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); this is a moderate, defense-in-depth issue rather than a top-tier emergency.
Modem denial of service in MediaTek baseband firmware allows an attacker operating a rogue base station within radio range to crash or reset a victim handset's modem through an out-of-bounds read (CWE-125) caused by an incorrect bounds check on attacker-influenced over-the-air data. The attacker must first get the target UE to camp on the malicious cell (CVSS 3.1 AV:A/AC:H), after which no privileges and no user interaction are required, and the only impact is loss of availability of the modem (A:H, C:N/I:N), yielding a 5.3 base score. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and applicability is limited to devices built on the enumerated MediaTek chipset models with vulnerable modem firmware, so this is a genuine but bounded, proximity-dependent availability risk rather than a mass-exploitation emergency.
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-level privilege to gain elevated code execution through an integer overflow (CWE-190), with no user interaction required. The flaw affects a broad set of MediaTek chipsets (including MT6893, MT6895, MT6983, MT6991, and MT8188) running unpatched firmware and is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, but MediaTek has published patch ID ALPS11296678 in its October 2026 security bulletin.
Local privilege escalation in the MediaTek display component lets a process that already holds System privilege trigger an out-of-bounds write in a display-path buffer, corrupting memory and potentially escalating to higher-level code execution with high impact to confidentiality, integrity, and availability. The defect is a missing bounds check (CWE-787) reachable without user interaction and with low attack complexity, but only from an existing System-privileged, on-device context (CVSS 3.1 6.7 Medium, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it functions as a second-stage escalation primitive rather than an initial-access or remote vector. Affected hardware spans a broad set of MediaTek chipsets including MT6991, MT6993, MT2718, MT8168-class MT8668/MT8678, MT8171, MT8188, MT8189, MT8196, MT8793, and MT8126; MediaTek has issued Patch ID ALPS11292777 (issue MSV-9195) and no public exploit code has been identified at time of analysis.
Denial of service in MediaTek cellular modem firmware lets an attacker running a rogue base station crash the modem of an attached device by delivering a malformed message that triggers a missing bounds check, severing cellular connectivity until the modem restarts. The flaw is availability-only (CVSS 5.3, AV:A/AC:H/PR:N/UI:N/C:N/I:N/A:H) and is gated by radio proximity plus the victim UE actually attaching to the attacker-controlled cell, so it is not reachable over the internet and carries no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and MediaTek has shipped fixes (patch IDs MOLY01864925 / MOLY01210562) covering more than 50 chipsets across the October 2026 product security bulletin.
Denial of service in MediaTek's cellular modem firmware can crash the baseband on a broad set of MediaTek chipsets - including MT6991, MT6988, MT6897, MT8755, MT6835, MT8792 and others - causing the device to drop connectivity or reset. Exploitation is unauthenticated (PR:N, UI:N) but requires the attacker to operate a rogue, attacker-controlled base station and to get the target user equipment to attach to it over the radio interface, which is why attack complexity is rated high (AV:A/AC:H) and impact is limited to availability (A:H; no confidentiality or integrity effect). MediaTek publishes fix identifiers MOLY01870473 / MOLY00814393 (issue MSV-9041) in its October 2026 product security bulletin; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with partial technical impact, keeping real-world priority moderate-to-low despite the large number of affected chipsets.
Out-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad set of affected MediaTek SoCs - including MT6768, MT6833, MT8186, MT8195 and MT6877 - when a victim opens or plays attacker-controlled media that reaches the vulnerable decode routine. Exploitation requires no additional execution privileges or authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but does require user interaction, since the crafted stream must actually be rendered by the decoder; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterised as a credible, above-average-priority mobile vulnerability rather than an emergency. MediaTek has assigned patch ID ALPS11383899 (issue MSV-9614) and published guidance in its October 2026 product security bulletin.
Local privilege escalation in the MediaTek APU (AI Processing Unit) driver allows an attacker with existing code execution on affected devices to trigger a use-after-free, achieving full compromise of confidentiality, integrity, and availability (CVSS 8.4). The flaw affects MediaTek chipsets MT8781, MT6993, MT6899, MT8668, MT8910, and MT8793, and requires no additional privileges or user interaction once local access is obtained. No public exploit code or active exploitation is confirmed at time of analysis.
An out-of-bounds write in MediaTek modem (baseband) firmware allows an attacker operating a rogue base station to escalate privileges on a wide range of MediaTek chipsets (e.g., MT6853, MT6980, MT6991, MT8798, MT6895) once the victim's device connects to that base station; no authentication is required, but exploitation is high-complexity and requires user interaction per the assessed vector. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is bounded by the need for RF proximity to a malicious base station rather than being a mass-exploitable remote flaw.
Local privilege escalation in MediaTek's APU (AI Processing Unit) allows a locally-executing attacker to corrupt memory via malformed input, potentially achieving kernel-level code execution on devices with affected chipsets (MT6899, MT8781, MT8910, MT8793, MT6993, MT8668). The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already run code on the device, such as a malicious Android app, with no additional privileges or user interaction needed. No public exploit identified at time of analysis, and the flaw is fixed by MediaTek patch ALPS11249004.
Local privilege escalation in MediaTek NeuroPilot on affected chipsets (MT8781, MT8189, MT6993, MT8793, MT8910, MT8668, MT8188, MT6881, MT8875) allows an attacker with local code execution to trigger an out-of-bounds write in the APU/AI driver, potentially gaining high-integrity code execution with no user interaction, though no additional privileges are needed once that local app context exists. Vendor patch ALPS11249062 is available; no public exploit identified at time of analysis. It is a high-priority patch target for affected MediaTek-based devices but is not remotely reachable, limiting its scope to privilege escalation rather than initial compromise.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an attacker who operates a rogue base station within radio range to escalate privileges on the target device without authentication and without any user interaction. Exploitation is not reachable over the internet: the CVSS vector AV:A/AC:H/PR:N/UI:N with C:H/I:H/A:H reflects that the attacker must be in adjacent radio proximity and must successfully induce the victim's UE to attach to the malicious base station, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a conditionally gated baseband flaw rather than a mass-exploitation emergency. No public exploit code has been identified at time of analysis; MediaTek has released a fix under Patch ID MOLY01778988 (Issue ID MSV-8897) in its October 2026 product security bulletin.
An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to escalate privileges on affected devices once the user equipment attaches to the attacker-controlled cell. The flaw has a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects dozens of MediaTek chipsets, including MT6833, MT6877, MT6983, MT6985, and MT6989, when they run unpatched modem firmware. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, and MediaTek has published a fix under Patch ID MOLY01778993 in its October 2026 product security bulletin.
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level privileges to escalate to kernel-level code execution via a type confusion that leads to an out-of-bounds write. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and no public exploit has been identified at the time of analysis. This is a post-compromise escalation step, not a remote or initial-access vector.
Local privilege escalation in MediaTek's mtee (MediaTek TEE) allows an attacker who already holds System privilege to exploit a missing bounds check, causing an out-of-bounds write that can elevate privileges on affected MediaTek chipsets. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and affects 25 listed MediaTek chipset models including MT8196, MT6768, MT6769, MT6833, MT6877, MT8186, and MT8188. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in MediaTek mtee allows a local attacker who already holds Android System privilege to exploit a CWE-843 type confusion and elevate code execution on affected MediaTek chipsets; user interaction is not required. The flaw is local-only (AV:L) and requires high privileges (PR:H), so it cannot be used for initial access or remote compromise and is primarily useful as a chain component after an attacker has already obtained a System-level foothold. MediaTek has published Patch ID ALPS11383899 in its October 2026 bulletin, and no public exploit identified at time of analysis.
Local privilege escalation in MediaTek's vdec (video decoder) component allows an attacker who already holds System privilege on an affected chipset to supply crafted input that triggers a type-confusion-driven out-of-bounds write, corrupting memory and achieving high confidentiality, integrity, and availability impact at a higher privilege level. The issue affects 24 MediaTek SoCs including MT8395, MT6833, MT6789, MT8195, MT6877, MT8189, MT8391, MT8676, MT8678, MT8793, MT8799, MT6855, MT8367, MT8781, MT8196, MT8910, MT8668, MT8188, MT8792, MT6769, MT6768, MT8186, MT8788E, and MT2718, across mobile, tablet, and embedded platforms. Exploitation is local only, requires the System-privilege prerequisite, and needs no user interaction; the CVSS 3.1 base score is 6.7 (MEDIUM) and no public exploit was identified at time of analysis, so the practical risk is a post-compromise escalation primitive rather than a remote entry point.
Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT6985, MT8195, and others listed in EUVD-2026-92196) and allows an attacker with physical access to the device to trigger an out-of-bounds write due to a missing bounds check, achieving high confidentiality and integrity impact. No authentication, existing execution privileges, or user interaction are required once physical access is obtained. No public exploit has been identified at time of analysis; the physical access prerequisite limits remote exploitation and confines realistic abuse to scenarios such as lost or stolen devices, border inspection, or supply-chain tampering.
Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, including MT6983, MT6895, MT6989, and MT6768, when running unpatched modem firmware. A local app with ordinary low privileges (PR:L) can access sensitive modem debug information without user interaction, yielding high confidentiality impact but no code execution or integrity/availability loss; CVSS is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation, but MediaTek patch MOLY01645293 and the October 2026 product security bulletin address the flaw.
Use-after-free memory corruption in MediaTek's apusys driver allows a local attacker who has already obtained Android System privilege (uid system) to escalate to kernel-level code execution on affected devices, with no user interaction required once that foothold exists. The flaw affects firmware running on a broad set of MediaTek SoCs - including MT6897, MT6899, MT6989, MT6991, MT8196, MT8678 and the other MT-series chipsets listed in MediaTek's October 2026 bulletin - and is addressed by Patch ID ALPS11076799 (Issue ID MSV-8143). Because the CVSS vector carries PR:H and AV:L, this is a second-stage privilege-escalation link that presupposes a prior System-level compromise rather than a standalone remotely reachable bug; no public exploit code or confirmed active exploitation was identified at time of analysis.
A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, producing a remote denial of service on affected handsets. The attack is unauthenticated (CVSS PR:N) and requires no user interaction (UI:N), but it only succeeds if the victim UE is already camped on a rogue base station the attacker controls, which is why the vector is scored AV:A/AC:H and the issue is assessed as moderate severity and low real-world priority. No public exploit code has been identified at the time of analysis, and impact is limited to availability of the modem - no confidentiality or integrity loss, and no code execution. MediaTek has issued a fix under Patch ID MOLY01774038 / Issue ID MSV-8911.
Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT6785, MT6833, MT6883, MT6985, MT6991 and MT8798 - where a missing bounds check during cellular message parsing produces an out-of-bounds read (CWE-126) that can crash the baseband. An attacker who operates a rogue base station and gets a victim UE to attach can trigger the fault with no authentication (PR:N) and no user interaction (UI:N), though the adjacent-network position and specialized radio hardware required drive the high attack complexity (AC:H) and the CVSS 3.1 score of 5.3, with impact limited to availability. Neither our independent assessment nor CISA's SSVC framework records known exploitation (Exploitation: none, Automatable: no), so no public exploit is identified at time of analysis.
Out-of-bounds read in MediaTek modem firmware (CWE-126) allows an attacker operating a rogue base station to trigger a memory over-read in the modem stack of any UE that connects to it, resulting in a remote denial of service (availability only; no data exposure or code execution). The issue affects a very wide set of MediaTek chipsets (MT6989, MT6990, MT6983, MT6768, MT6765 and dozens more) enumerated in MediaTek's October 2026 product security bulletin. No authentication or user interaction is required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.3), but practical exploitation demands radio proximity, rogue base-station infrastructure, and the ability to coerce device attachment - CISA SSVC rates exploitation 'none' and automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine but moderate-priority issue rather than a critical one.
Denial of service against the cellular modem firmware shipped in a very broad range of MediaTek chipsets (MT6739 through MT6993/MT8893 families) arises from an out-of-bounds read caused by a missing permission check. The precondition is that the victim user equipment has already attached to a rogue base station under the attacker's control, meaning the adversary must operate radio infrastructure within range and successfully induce attachment (downgrade or stronger-signal lure) - hence the AV:A/AC:H scoring and the LOW real-world priority despite the enormous chipset footprint. Once attached, exploiting the flaw requires no authentication (PR:N) and no user interaction (UI:N), but the outcome is availability-only (A:H, with no confidentiality or integrity impact); there is confirmed no active exploitation (CISA KEV absent), no public exploit code identified at time of analysis, and no EPSS signal was provided in the source data.
A missing permission check in the MediaTek AIDL (Android Interface Definition Language) component allows an attacker who already holds the Android System privilege to escalate to higher privileges locally, with no user interaction required. The expected impact is high across confidentiality, integrity, and availability (CVSS 3.1 base 6.7, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but the local-only vector and the PR:H precondition mean an ordinary unprivileged app cannot trigger it directly - it is only useful as a second-stage step in an existing exploit chain or for already-privileged malware. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); this is a moderate, defense-in-depth issue rather than a top-tier emergency.
Modem denial of service in MediaTek baseband firmware allows an attacker operating a rogue base station within radio range to crash or reset a victim handset's modem through an out-of-bounds read (CWE-125) caused by an incorrect bounds check on attacker-influenced over-the-air data. The attacker must first get the target UE to camp on the malicious cell (CVSS 3.1 AV:A/AC:H), after which no privileges and no user interaction are required, and the only impact is loss of availability of the modem (A:H, C:N/I:N), yielding a 5.3 base score. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and applicability is limited to devices built on the enumerated MediaTek chipset models with vulnerable modem firmware, so this is a genuine but bounded, proximity-dependent availability risk rather than a mass-exploitation emergency.
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-level privilege to gain elevated code execution through an integer overflow (CWE-190), with no user interaction required. The flaw affects a broad set of MediaTek chipsets (including MT6893, MT6895, MT6983, MT6991, and MT8188) running unpatched firmware and is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, but MediaTek has published patch ID ALPS11296678 in its October 2026 security bulletin.
Local privilege escalation in the MediaTek display component lets a process that already holds System privilege trigger an out-of-bounds write in a display-path buffer, corrupting memory and potentially escalating to higher-level code execution with high impact to confidentiality, integrity, and availability. The defect is a missing bounds check (CWE-787) reachable without user interaction and with low attack complexity, but only from an existing System-privileged, on-device context (CVSS 3.1 6.7 Medium, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it functions as a second-stage escalation primitive rather than an initial-access or remote vector. Affected hardware spans a broad set of MediaTek chipsets including MT6991, MT6993, MT2718, MT8168-class MT8668/MT8678, MT8171, MT8188, MT8189, MT8196, MT8793, and MT8126; MediaTek has issued Patch ID ALPS11292777 (issue MSV-9195) and no public exploit code has been identified at time of analysis.
Denial of service in MediaTek cellular modem firmware lets an attacker running a rogue base station crash the modem of an attached device by delivering a malformed message that triggers a missing bounds check, severing cellular connectivity until the modem restarts. The flaw is availability-only (CVSS 5.3, AV:A/AC:H/PR:N/UI:N/C:N/I:N/A:H) and is gated by radio proximity plus the victim UE actually attaching to the attacker-controlled cell, so it is not reachable over the internet and carries no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and MediaTek has shipped fixes (patch IDs MOLY01864925 / MOLY01210562) covering more than 50 chipsets across the October 2026 product security bulletin.
Denial of service in MediaTek's cellular modem firmware can crash the baseband on a broad set of MediaTek chipsets - including MT6991, MT6988, MT6897, MT8755, MT6835, MT8792 and others - causing the device to drop connectivity or reset. Exploitation is unauthenticated (PR:N, UI:N) but requires the attacker to operate a rogue, attacker-controlled base station and to get the target user equipment to attach to it over the radio interface, which is why attack complexity is rated high (AV:A/AC:H) and impact is limited to availability (A:H; no confidentiality or integrity effect). MediaTek publishes fix identifiers MOLY01870473 / MOLY00814393 (issue MSV-9041) in its October 2026 product security bulletin; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with partial technical impact, keeping real-world priority moderate-to-low despite the large number of affected chipsets.