EUVD-2026-26889Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
In Modem, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01760138; Issue ID: MSV-6148.
AnalysisAI
Heap buffer overflow in MediaTek modem firmware allows remote denial of service when a device connects to an attacker-controlled base station. The vulnerability affects a wide range of MediaTek chipsets and can crash the modem without requiring user interaction or special privileges. No public exploit code has been identified, and CISA has not listed this in the Known Exploited Vulnerabilities catalog, though the low EPSS score (0.07%) suggests limited real-world exploitation likelihood despite the attack vector requiring only adjacent network access.
Technical ContextAI
The vulnerability resides in the modem subsystem of MediaTek-based mobile devices, which handles cellular communications including baseband processing and connection management to cellular base stations. The heap buffer overflow (CWE-120) occurs during modem operations, likely in protocol parsing or signal handling during base station connection establishment. The adjacent network attack vector (AV:A) indicates the attacker must be positioned as an intermediary (rogue base station) within radio range to send specially crafted wireless signals that trigger the overflow. This affects baseband firmware across multiple MediaTek chipset generations (MT6xxx, MT8xxx, MT2xxx families), which are widely used in mid-range and budget Android devices, IoT modems, and feature phones.
RemediationAI
Apply the MediaTek security patch identified as MOLY01760138 (Issue ID: MSV-6148) to affected modem firmware. Device manufacturers (OEMs) must incorporate this patch into their device firmware releases and push updates through official update mechanisms. End users should install all available system and security updates from their device manufacturer when released, as OEMs will integrate MediaTek's modem patch into their builds. Interim mitigations for high-risk environments include: disable cellular connectivity when not required (trade-off: loss of mobile connectivity); physically distance devices from untrusted networks or locations where rogue base stations might be deployed (trade-off: limits mobility); restrict device usage to trusted carrier networks only by disabling roaming to unknown networks via device settings (trade-off: limited roaming capability). However, these mitigations only reduce exposure and do not eliminate the vulnerability - patching remains the primary remediation. Consult MediaTek Product Security Bulletin (May 2026) and your device manufacturer's advisory for patch availability timelines.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today