EUVD-2026-40872
GHSA-67vv-7c97-f7h6
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent attack vector (rogue base station required nearby), high complexity (specialized radio equipment), no privileges on target, DoS-only impact.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01816800; Issue ID: MSV-6842.
AnalysisAI
Remote denial-of-service in MediaTek modem firmware across 80+ chipset families allows an attacker operating a rogue cellular base station to crash affected devices by sending malformed input the modem fails to validate. The vulnerability (CWE-288) requires no privileges on the target device and no user interaction - a device that autonomously connects to the attacker's false base station is sufficient. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target User Equipment (UE) - a smartphone, tablet, or other cellular device powered by one of the 80+ affected MediaTek chipsets - has connected to a rogue base station controlled by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a moderate-severity, adjacent-network, high-complexity attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor with access to software-defined radio (SDR) equipment deploys a rogue LTE or NR base station broadcasting a stronger signal than legitimate towers in a target's vicinity - a technique sometimes called an IMSI catcher or false base station. A target device running a vulnerable MediaTek modem autonomously attaches to this rogue cell; the attacker then transmits a specially crafted over-the-air protocol message that the modem's input validation logic fails to handle correctly, triggering a system crash and rendering the device temporarily inoperable. … |
| Remediation | The patch for this vulnerability is identified as MOLY01816800 (Issue ID: MSV-6842), released as part of the MediaTek July 2026 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/July-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Local privilege escalation in MediaTek's geniezone hypervisor component affects 36 distinct chipsets spanning budget to
Out-of-bounds write in MediaTek's slbc (secure local buffer component) due to type confusion allows local privilege esca
Local privilege escalation in MediaTek geniezone component due to missing bounds check allows System-privileged actors t
Local privilege escalation in MediaTek chipsets (MT6765, MT8893, MT8791T, and 19 others) due to missing permission check
Remote denial of service in MediaTek modem firmware across 47+ chipset variants allows attackers to crash the modem via
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today