EUVD-2026-26890Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01753620; Issue ID: MSV-6100.
AnalysisAI
Remote denial of service in MediaTek modem firmware across 47+ chipset variants allows attackers to crash the modem via incorrect error handling when a user equipment device connects to a rogue base station, requiring no authentication or user interaction. The vulnerability affects a broad range of MediaTek cellular chipsets (MT6855, MT6985, MT8793, and others) and carries a CVSS 6.5 score reflecting network-adjacent attack vector and high availability impact. Patch MSV-6100 / MOLY01753620 is available from MediaTek.
Technical ContextAI
The vulnerability resides in the modem firmware's radio access network (RAN) stack, specifically in the handling of malformed or unexpected protocol messages from base station connections. CWE-617 (Reachable Assertion) indicates the root cause is an assertion or validation check that can be triggered to cause a crash when the modem receives crafted signals or control messages from a rogue base station. The attack vector is adjacent (AV:A) rather than purely network because the modem must be in active communication with the attacker-controlled base station; however, any device in cellular coverage of such a station is at risk. The issue affects MediaTek's modular chipset design, which powers Android devices, IoT equipment, and telecommunications infrastructure globally. CPE data confirms the vulnerability spans multiple modem architecture families (Helio, Dimensity, and other MediaTek lines).
RemediationAI
Apply MediaTek firmware patch MOLY01753620 (Patch ID MSV-6100) released in May 2026 via the standard OTA update mechanism for devices using affected chipsets. End users should enable automatic system updates and contact their device manufacturer (Samsung, Xiaomi, OPPO, Vivo, Qualcomm reference designs, telecom vendors) for specific firmware version numbers that include this fix, as MediaTek patch identifiers map to vendor-specific release versions. For infrastructure operators (cellular carriers, private network operators), coordinate with MediaTek and equipment vendors for modem firmware updates to enterprise gateways and base station equipment. No workaround exists to prevent the crash other than avoiding connection to untrusted networks, which is impractical for mobile devices. The modem will automatically reconnect after crash, resulting in brief service interruption but not data loss. Apply patches as part of regular maintenance windows rather than emergency response, given the low exploitation likelihood (EPSS 0.08%) and non-critical impact.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Local privilege escalation in MediaTek's geniezone hypervisor component affects 36 distinct chipsets spanning budget to
Out-of-bounds write in MediaTek's slbc (secure local buffer component) due to type confusion allows local privilege esca
Local privilege escalation in MediaTek geniezone component due to missing bounds check allows System-privileged actors t
Local privilege escalation in MediaTek chipsets (MT6765, MT8893, MT8791T, and 19 others) due to missing permission check
Remote denial of service in MediaTek modem chipsets allows unauthenticated attackers to crash the system via a logic err
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today