Executive brief
MediaTek's geniezone security component is vulnerable to an out-of-bounds memory write due to missing input validation. An attacker who already has system-level privileges could exploit this to escalate their access further or corrupt system memory, potentially leading to device compromise or malfunction.
Technical details
This vulnerability is a missing bounds check leading to an out-of-bounds write (CWE-787) in MediaTek's geniezone component. The flaw allows an attacker with System privilege to write data beyond allocated buffer boundaries. Since the advisory states that System privilege is required and user interaction is not needed, exploitation requires the attacker to already have elevated system access on the device. Successful exploitation could enable privilege escalation, memory corruption, or arbitrary code execution with system-level permissions. MediaTek issued patch ALPS10965373 to address this issue.
Affected products
- MediaTek geniezone
Timeline
- 2026-08-03: disclosed
- 2026-08-03: patched: Patch ID: ALPS10965373