EUVD-2026-40874
GHSA-69rh-fj32-xxwg
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:N reflects cellular network delivery; AC:H captures the rogue base station prerequisite; PR:N and UI:N are accurate as the modem processes signals autonomously; A:H for modem crash; C:N and I:N as no data exfiltration or integrity impact is described.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
4DescriptionCVE.org
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01267281 / MOLY01318201; Issue ID: MSV-6486.
AnalysisAI
Out-of-bounds write in MediaTek modem firmware allows a network-adjacent attacker controlling a rogue cellular base station to remotely crash affected User Equipment (UE), resulting in denial of service. Thirty-three distinct MediaTek chipsets - spanning flagship mobile SoCs (MT6991, MT6989, MT6985) to tablet and IoT chipsets (MT8795T, MT8893) - contain the vulnerable modem component identified under Patch IDs MOLY01267281 and MOLY01318201. No public exploit code has been identified at time of analysis, and the attack is non-trivial due to the requirement for attacker-controlled cellular infrastructure, but the sheer deployment scale of affected chipsets across Android devices makes the aggregate exposure significant.
Technical ContextAI
The vulnerability resides in the MediaTek modem baseband firmware (CWE-787: Out-of-bounds Write), which handles the cellular protocol stack for 4G/5G radio communications on affected SoCs. A missing bounds check in the modem's signal or message processing path allows a crafted wireless transmission from a rogue base station to write data beyond the intended buffer boundary in modem memory. Affected chipsets are identified by CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* and include high-volume Dimensity-series mobile SoCs (MT6985, MT6989, MT6991, MT6993) and Kompanio/Helio tablet chipsets (MT8795T, MT8893, MT8883). The flaw is in the modem subsystem rather than the application processor, meaning it operates largely independently of the host OS and is not gated by Android security layers.
RemediationAI
MediaTek has released patches under Patch IDs MOLY01267281 and MOLY01318201 (Issue ID: MSV-6486), distributed to OEM partners via the July 2026 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/July-2026. End users should apply Android security updates from their device manufacturer as soon as patches incorporating these modem fixes become available; the exact OEM firmware version will vary by device. No specific patched modem firmware version is publicly enumerated in available data - affected version remediation is confirmed by vendor advisory only. As a compensating control where patching is delayed, disabling cellular data and relying on Wi-Fi calling reduces the attack surface by limiting modem exposure to cellular base station signaling, though voice calls over the native cellular stack may still be affected. Enabling VoLTE airplane-mode fallback and restricting devices to known network operators via carrier lock settings can reduce exposure to rogue base stations in high-risk environments, at the cost of reduced cellular availability.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today