EUVD-2026-40873
GHSA-7cqg-gq5x-qr9q
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:A and AC:H reflect mandatory rogue base station proximity; C:H for meaningful modem-layer data leakage; I:N and A:N as no write or availability impact occurs.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01811421; Issue ID: MSV-6788.
AnalysisAI
Information disclosure in MediaTek modem firmware across 67+ chipset models enables a network-adjacent attacker operating a rogue cellular base station to extract sensitive data from a victim's User Equipment (UE) without any privileges or user interaction. The root cause is improper input validation (CWE-288) in the modem baseband stack, allowing a fake cell tower to elicit confidential data from connected devices. No active exploitation has been confirmed by CISA KEV, and SSVC assessment rates exploitation as 'none' at time of analysis, though the architecture of the attack closely resembles IMSI-catcher and stingray-type tradecraft used in targeted surveillance operations.
Technical ContextAI
The vulnerability resides in MediaTek's modem (baseband) firmware, the component responsible for managing cellular radio communications (LTE/5G protocols) on the chipset. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates the modem fails to properly validate inputs received over the radio interface from a network node - in this case a base station. Because the UE inherently trusts the cellular network it associates with, a rogue eNodeB or gNB can present crafted protocol messages that bypass input validation, causing the modem to disclose information it should not expose. The CPE string (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*) confirms all versions of the listed chipset families are affected. The affected chipsets span MediaTek's Dimensity and Helio product lines used in LTE and 5G-capable Android devices.
RemediationAI
The primary remediation is applying patch MOLY01811421 released by MediaTek, as referenced in the July 2026 Product Security Bulletin (https://corp.mediatek.com/product-security-bulletin/July-2026). Device OEMs and carriers must integrate this modem firmware update into their own security patch releases; end-users should apply Android OTA updates as soon as device manufacturers distribute them. Because the attack requires physical proximity and a rogue base station, users in high-risk environments (government, critical infrastructure, journalists) can reduce exposure by disabling 2G/LTE fallback where 5G standalone networks are available, as older generation protocols offer fewer base station authentication mechanisms. Enabling airplane mode in untrusted environments eliminates the attack surface entirely at the cost of cellular connectivity. 'Network-level' detection of rogue base stations via mobile threat defense (MTD) solutions can provide alerting when a device associates with a suspicious cell tower. No workaround fully substitutes for the modem firmware patch.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today