EUVD-2026-40872
GHSA-67vv-7c97-f7h6
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent attack vector (rogue base station required nearby), high complexity (specialized radio equipment), no privileges on target, DoS-only impact.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01816800; Issue ID: MSV-6842.
AnalysisAI
Remote denial-of-service in MediaTek modem firmware across 80+ chipset families allows an attacker operating a rogue cellular base station to crash affected devices by sending malformed input the modem fails to validate. The vulnerability (CWE-288) requires no privileges on the target device and no user interaction - a device that autonomously connects to the attacker's false base station is sufficient. No public exploit code has been identified at time of analysis, and SSVC classifies exploitation status as none, though the widespread chipset deployment across Android handsets and IoT hardware makes the affected attack surface extremely broad.
Technical ContextAI
The vulnerability resides in the modem firmware component of MediaTek SoCs (CPE: cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*), which handles cellular protocol stack processing - including radio resource management, base station attachment, and over-the-air message parsing. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) describes the root cause class: the modem's input validation logic can be reached via an alternate, unauthenticated channel - specifically, a rogue LTE/NR base station (eNodeB/gNodeB) that the User Equipment (UE) autonomously attaches to based on signal strength. Malformed protocol messages delivered over this channel are not sufficiently validated before processing, triggering an improper input validation condition (related to CWE-20) that results in a system crash. The attack path exploits the asymmetric trust relationship inherent in mobile network architecture, where UEs authenticate to base stations but cannot cryptographically verify the legitimacy of the base station itself in all protocol states prior to mutual authentication completion.
RemediationAI
The patch for this vulnerability is identified as MOLY01816800 (Issue ID: MSV-6842), released as part of the MediaTek July 2026 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/July-2026. Device manufacturers (OEMs) using affected chipsets must integrate this modem firmware patch into their device security updates and push them to end users. End users should apply any available July 2026 or later OEM security patches for their Android or other MediaTek-powered devices. Because the exact patched firmware version number is not independently confirmed in the available data (only the patch ID is disclosed), users should verify update availability through their device manufacturer's security channels. As a compensating control where patching is not immediately available, limiting device exposure to untrusted RF environments (e.g., using airplane mode in high-risk physical locations, or disabling cellular and relying on Wi-Fi calling) reduces exposure, though this is operationally disruptive. Enterprise MDM policies can enforce cellular radio restrictions on managed devices as a temporary measure. Note that these workarounds carry significant usability trade-offs and should be considered only for high-risk individuals in targeted scenarios.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today