Description
In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11049569; Issue ID: MSV-7931.
Published: 2026-08-03
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw arises from a missing bounds check in the Hardware Flight Recorder Protocol (HFRP) of the MediaTek chipset. An out‑of‑bounds write can corrupt internal data structures, which, if leveraged by an attacker, may enable them to gain System‑level privileges. The weakness is a classic memory corruption bug classified as CWE‑787.

Affected Systems

The vulnerability affects MediaTek chipsets. No specific release or firmware version is listed in the Advisory, so all current versions may be susceptible. Users should verify the firmware version against MediaTek’s catalogue.

Risk and Exploitability

Exploitation requires a local presence with already elevated System privileges and does not need user interaction. The EPSS score is < 1% and the CVSS score is 6, indicating moderate severity. The flaw is not listed in the CISA KEV catalog, suggesting a limited exploitation window. Nonetheless, the potential to gain full system control warrants immediate attention.

Generated by OpenCVE AI on August 4, 2026 at 10:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the device firmware to a version that includes patch ALPS11049569 (Issue ID MSV‑7931).
  • Revoke or limit the System‑level privileges assigned to the HFRP component so it cannot run with full system access.
  • Implement monitoring of HFRP activity and logs for anomalous behavior to detect potential exploitation attempts.

Generated by OpenCVE AI on August 4, 2026 at 10:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Mediatek
Mediatek mt6993
Mediatek mt6993 Firmware
CPEs cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*
cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*
Vendors & Products Mediatek
Mediatek mt6993
Mediatek mt6993 Firmware

Tue, 04 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Title MediaTek HFRP Out‑of‑Bounds Write Leading to Local Privilege Escalation

Mon, 03 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Title MediaTek HFRP Out‑of‑Bounds Write Leading to Local Privilege Escalation

Mon, 03 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Mediatek, Inc.
Mediatek, Inc. mediatek Chipset
Vendors & Products Mediatek, Inc.
Mediatek, Inc. mediatek Chipset

Mon, 03 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Description In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11049569; Issue ID: MSV-7931.
Weaknesses CWE-787
References

Subscriptions

Mediatek Mt6993 Mt6993 Firmware
Mediatek, Inc. Mediatek Chipset
cve-icon MITRE

Status: PUBLISHED

Assigner: MediaTek

Published:

Updated: 2026-08-05T03:56:54.489Z

Reserved: 2025-11-03T01:30:59.022Z

Link: CVE-2026-20485

cve-icon Vulnrichment

Updated: 2026-08-03T19:01:29.542Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-03T03:16:43.653

Modified: 2026-08-19T16:51:02.700

Link: CVE-2026-20485

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T11:00:07Z

Weaknesses