CVE-2022-26456: 
NixOS vulnerability analysis and mitigation

CVE-2022-26456 is a medium severity vulnerability discovered in MediaTek's vow component that affects multiple MediaTek chipsets. The vulnerability was disclosed in September 2022 and involves a symbolic link following issue that could lead to information disclosure (MediaTek Bulletin).

The vulnerability is classified as a Unix Symbolic Link (Symlink) Following issue (CWE-61). It exists in the vow component of MediaTek chipsets and could allow local information disclosure due to improper symbolic link handling. The vulnerability has been assigned a CVSS v3.1 base score of 4.4 MEDIUM with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability could lead to local information disclosure if exploited successfully. The attack requires System execution privileges, but user interaction is not needed for exploitation (MediaTek Bulletin).

The vulnerability requires local access and high privileges for exploitation. No user interaction is needed once the attacker has the required access level. There are no public reports of this vulnerability being exploited in the wild (MediaTek Bulletin).

The vulnerability affects Android 11.0 devices using specific MediaTek chipsets including MT6769, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT6983, MT8185, MT8789, MT8791, and MT8797. MediaTek has released security patches to address this vulnerability (MediaTek Bulletin).