Out-of-bounds read in MT6580, MT6735, MT6737, MT6739, MT6750S, MT6753, MT6755S, MT6757…
Priority LOW 24CWE-125Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05594988; Issue ID: ALPS05594988.
Why it matters now
EPSS 0.00126 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | MT6580, MT6735, MT6737, MT6739, MT6750S, MT6753, MT6755S, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6771, MT6779, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6877, MT6885, MT6889, MT6893, MT8163, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8183, MT8185, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8735A, MT8735B, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8797 | Android 10.0, 11.0 | — | No fix listed | CNA |
- MT6580, MT6735, MT6737, MT6739, MT6750S, MT6753, MT6755S, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6771, MT6779, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6877, MT6885, MT6889, MT6893, MT8163, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8183, MT8185, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8735A, MT8735B, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8797 Vendor— Affected Android 10.0, 11.0 Fixed in — No fix listed CNA
CPE configurations NVD · 51
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | |
| cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | |
| cpe:2.3:h:mediatek:mt6580:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6735:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6737:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6750s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6753:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6755s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6757:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6757c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
- cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Google
- cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Google
- cpe:2.3:h:mediatek:mt6580:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6735:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6737:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6750s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6753:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6755s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6757:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6757c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Show 41 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:mediatek:mt6757cd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6757ch:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8163:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8167:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8167s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8168:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8173:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8175:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8183:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8185:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8321:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8362a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8365:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8385:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8735a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8735b:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
- cpe:2.3:h:mediatek:mt6757cd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6757ch:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8163:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8167:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8167s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8168:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8173:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8175:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8183:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8185:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8321:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8362a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8365:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8385:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8735a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8735b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-0624
- 2026-10-03 Alias added: GHSA-42cm-7wp8-4pv7
References
More Google Android vulnerabilities
- TI-2026-42236 Improper authorization in Google Android KEVCVSS 3.1HIGH 8.8
- TI-2025-30821 Use after free in Google Android KEVCVSS 3.1HIGH 8.8
- TI-2023-17777 Improper privilege management in Google Android KEVCVSS 3.1HIGH 8.8
- TI-2025-30872 Integer overflow in Google Android KEVCVSS 3.1HIGH 8.4
- TI-2024-21766 there is a possible way to bypass due to a logic error in the code. KEVCVSS 3.1HIGH 8.1
- TI-2025-30849 Missing authentication in Google Android KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2021-0624 · CVE Program
- CVE-2021-0624 · NVD
- FIRST EPSS
- GHSA-42cm-7wp8-4pv7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences