EUVD-2026-72197
GHSA-p2x2-q5j5-2mj9
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:A because the rogue base station must be in cellular radio range; AC:H for the operational difficulty of forcing UE attachment; C:N/I:N as only modem DoS results.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00755024; Issue ID: MSV-7865.
AnalysisAI
Remote denial-of-service in MediaTek Modem firmware affects 19 chipset variants spanning the MT6xxx and MT8xxx families - when a device embedding an affected chipset connects to an attacker-controlled rogue base station, a missing bounds check (CWE-617: Reachable Assertion) in the modem subsystem triggers a system crash, causing loss of connectivity. The CVSS score of 5.3 (AV:A/AC:H) reflects the elevated operational complexity of deploying rogue cellular infrastructure to exploit this flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the target device must contain one of the 19 affected MediaTek chipsets running unpatched modem firmware, and (2) the device must successfully attach to an attacker-operated rogue base station - requiring the attacker to physically deploy radio infrastructure broadcasting a stronger signal than the legitimate carrier within range of the target. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:A/AC:H accurately captures the practical threat model: exploitation is bounded by the attacker's ability to deploy rogue cellular base station (fake eNB/gNB) infrastructure within radio range of the target device and to force the device to camp on the rogue cell - a significant operational barrier that limits this to well-resourced adversaries rather than opportunistic attackers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | MediaTek has released a modem firmware patch identified as MOLY00755024 (Issue ID: MSV-7865), documented in the September 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/September-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today