EUVD-2026-19568Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01088681; Issue ID: MSV-4460.
AnalysisAI
Out-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-controlled rogue cellular base stations. The vulnerability affects over 60 MediaTek chipset models widely deployed in smartphones and IoT devices, exploitable by adjacent network attackers without authentication (CVSS:3.1 AV:A/PR:N). While EPSS scores this at only 6% exploitation probability (18th percentile) and no active exploitation is confirmed at time of analysis, the attack s
Technical ContextAI
This vulnerability resides in the MediaTek modem baseband processor firmware, specifically in code handling cellular network communications. The root cause is CWE-787 (Out-of-bounds Write), where the modem fails to validate buffer boundaries when processing data from cellular base stations. MediaTek chipsets integrate modem, application processor, and connectivity functions on a single SoC; the affected modem component operates at high privilege levels with direct hardware access. The vulnerability spans 63 distinct chipset models including flagship (MT6989, MT6990, MT6991), mid-range (MT6833, MT6877, MT6985), and specialized IoT variants (MT2735, MT2737, MT8668-MT8893 series). The CVSS vector AV:A (Adjacent Network) reflects the cellular radio attack surface, requiring the attacker to operate a rogue base station within radio range of victim devices. The missing bounds check allows malicious Over-The-Air (OTA) cellular protocol messages to write beyond allocated memory buffers during protocol stack processing, potentially corrupting modem firmware memory structures.
RemediationAI
MediaTek released firmware patch MOLY01088681 addressing the modem bounds check vulnerability, documented in their April 2026 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/April-2026. End users cannot directly apply MediaTek patches; device manufacturers (Samsung, Xiaomi, Oppo, Vivo, Realme, and others) must integrate the modem firmware fix into OEM-specific system updates. Users should immediately check for and install the latest security updates from their device manufacturer, prioritizing devices used in sensitive environments. OEMs should expedite integration of MOLY01088681 into monthly security maintenance releases. For enterprise deployments, Mobile Device Management (MDM) administrators should enforce automatic security updates and verify patch deployment across managed device fleets. As a partial mitigation until patches deploy, organizations can implement network policies restricting device roaming in high-risk geographic areas, though this does not prevent determined attackers with portable rogue base stations. Security teams should monitor for anomalous cellular behavior including unexpected base station connections, signal strength anomalies, or devices repeatedly losing and re-establishing network registration, though sophisticated attacks may not produce detectable signatures.
More in Mediatek Chipset
View allHeap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today