CVE-2022-20012
Description
Integer overflow in MediaTek mdp driver leads to local memory corruption and privilege escalation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Integer overflow in MediaTek mdp driver leads to local memory corruption and privilege escalation.
Vulnerability
The MDP (Mobile Display Processor) driver in certain MediaTek chipsets contains an integer overflow vulnerability [1]. This memory corruption issue exists in the mdp driver code and can be triggered without user interaction. The vulnerability is present in affected chipsets as listed in the January 2022 MediaTek Product Security Bulletin [1], with a patch identified as ALPS05836478.
Exploitation
An attacker requires local access to the device and no additional execution privileges [1]. No user interaction is needed for exploitation [1]. The exploitation sequence involves triggering an integer overflow in the mdp driver, leading to memory corruption.
Impact
Successful exploitation allows an attacker to achieve local escalation of privilege [1]. The impact includes memory corruption, which can lead to arbitrary code execution at an elevated privilege level.
Mitigation
MediaTek notified device OEMs at least two months before the January 2022 publication date [1]. The patch ID is ALPS05836478 [1]. Affected devices should receive an update from their OEM. No workarounds are documented.
AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- MediaTek, Inc./MT6580, MT6739, MT6750, MT6750S, MT6753, MT6755, MT6757, MT6761, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8127, MT8163, MT8167, MT8168, MT8169, MT8173, MT8183, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8765, MT8788v5Range: Android 10.0, 11.0, 12.0
Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
1- corp.mediatek.com/product-security-bulletin/January-2022mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.