EUVD-2026-40871
GHSA-v5qh-c8xh-h5f9
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent radio vector (AV:A) with high complexity (AC:H) for the rogue-base-station precondition; no privileges or interaction needed, full high impact confined to the modem subsystem.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01402160; Issue ID: MSV-7298.
AnalysisAI
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a rogue base station to corrupt modem memory via a missing bounds check (out-of-bounds write, CWE-787). Once a target UE camps on the attacker-controlled cell, exploitation requires no user interaction and no pre-existing privileges, potentially yielding privilege escalation within the modem subsystem. Tracked in MediaTek's July 2026 Product Security Bulletin (Patch ID MOLY01402160); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The flaw lives in the cellular baseband (modem) stack that runs on MediaTek's MT-series application/modem SoCs, which handle the LTE/5G radio protocol layers beneath the Android OS. CWE-787 (out-of-bounds write) indicates that attacker-influenced data received over the air is processed without proper length or bounds validation, letting a write run past the intended buffer and corrupt adjacent modem memory. Because the vulnerable code path executes on the modem's isolated processor rather than the Android application processor, exploitation targets a trust boundary that sits below the OS. The CPE (cpe:2.3:a:mediatek,_inc.:mediatek_chipset) and the EUVD list enumerate a broad range of affected parts spanning low-end (e.g., MT6739, MT6761), mainstream (MT6768, MT6789), and flagship-class (MT6983, MT6985, MT6989, MT6990, MT6991) chipsets, plus MT87xx/MT88xx families used in tablets and other devices.
RemediationAI
Apply the MediaTek fix identified as Patch ID MOLY01402160 (Issue ID MSV-7298) as delivered through your device OEM's firmware/security update; this is best described as 'Patch available per vendor advisory' since the July 2026 MediaTek Product Security Bulletin (https://corp.mediatek.com/product-security-bulletin/July-2026) does not publish a single tagged firmware version number, and device availability depends on each OEM's rollout. Until the modem firmware update reaches a given device, practical compensating controls target the rogue base station prerequisite: where supported, disable 2G/legacy-radio fallback and enable carrier-managed or device-level protection against downgrade/false base stations, which reduces exposure but can break connectivity in areas with only legacy coverage; advise high-risk users to use airplane mode or Wi-Fi-only in untrusted physical locations, at the cost of cellular reachability. There is no host-side configuration that fully removes the baseband code path, so firmware patching is the only complete remediation. Track OEM security bulletins and confirm the July 2026 patch level is installed via the device's Android security patch/update screen.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets
Local privilege escalation in MediaTek's geniezone hypervisor component affects 36 distinct chipsets spanning budget to
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today