EUVD-2026-92184
GHSA-gx55-632p-3gpx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeploy rogue base station near target
-
DeliveryInduce victim UE to attach
-
ExploitSend malformed modem message
-
ExecutionTrigger out-of-bounds read in baseband
-
ImpactCrash modem (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
|
| Exploitation Conditions | Exploitation requires the attacker to operate a rogue base station within radio range and to cause the victim UE to connect to it (AV:A), after which a malformed modem-layer message triggers the out-of-bounds read; this connection prerequisite is the core limiting factor. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the High attack complexity (AC:H) reflects the physical proximity, rogue-cell infrastructure, and the need to coerce device attachment, which substantially narrows realistic exploitation. Impact is limited to denial of service (availability only; C:N/I:N) with no code execution or data exposure. Affected scope is MediaTek chipsets listed in the October 2026 bulletin (e.g., MT6989, MT6990, MT6983, MT6768, MT6765 and many others). |
| Impact | This is a genuine-but-moderate-priority issue, not a critical one. The CVSS 3.1 base score is 5.3 (Medium), driven entirely by an availability impact (A:H) with no confidentiality or integrity effect (C:N/I:N). Multiple signals align to keep real-world risk low: the attack vector is Adjacent (AV:A), not Network, meaning the attacker must be within radio range operating a rogue base station; attack complexity is High (AC:H), reflecting the non-trivial setup and the requirement that a victim UE actually attach to the attacker-controlled cell. CISA's SSVC framework reinforces this - Exploitation: none, Automatable: no, Technical Impact: partial - so there is no mass-exploitation pathway. No EPSS score was provided in the input, and there is no KEV listing and no POC indicator, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (medium severity, availability-only, adjacent vector, no automation), with no contradictions to flag. The net effect is a targeted, proximity-based denial-of-service rather than a widespread or weaponizable threat; priority should be routine patching via the MediaTek October 2026 bulletin rather than emergency response. |
| Exploit ScenarioDerived | An attacker stands up a rogue cellular base station (IMSI-catcher-style) and induces a nearby MediaTek-powered device to attach to it. The rogue cell then sends a malformed modem-layer message that triggers an out-of-bounds read in the baseband, crashing the modem and causing a denial of service on the victim's device. No POC or exploit code is identified in the provided data, and the high attack complexity plus required radio proximity make this a targeted rather than opportunistic attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Out-of-bounds read in MediaTek modem firmware (CWE-126) allows an attacker operating a rogue base station to trigger a memory over-read in the modem stack of any UE that connects to it, resulting in a remote denial of service (availability only; no data exposure or code execution). The issue affects a very wide set of MediaTek chipsets (MT6989, MT6990, MT6983, MT6768, MT6765 and dozens more) enumerated in MediaTek's October 2026 product security bulletin. No authentication or user interaction is required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.3), but practical exploitation demands radio proximity, rogue base-station infrastructure, and the ability to coerce device attachment - CISA SSVC rates exploitation 'none' and automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine but moderate-priority issue rather than a critical one.
RemediationAI
MediaTek has provided a fix identified by Patch ID MOLY01774038 (Issue ID MSV-8913) in its October 2026 product security bulletin (https://www.mediatek.com/product-security-bulletin/October-2026); because the bulletin is chipset-level, the corresponding patched baseband cannot be named as a discrete version here, and actual availability depends on the device OEM and carrier shipping an updated firmware build - patch available per vendor advisory, released end-user firmware version not independently confirmed. Track and apply OEM/carrier updates for each affected device or module and verify the baseband build date against the bulletin. Where an update cannot be deployed immediately, the effective compensating control is to remove the attack path: disable automatic network selection and legacy 2G/GSM (and, where possible, 3G) fallback so the UE cannot be downgraded onto a rogue cell, and prefer 5G standalone operation with strong mutual authentication - the trade-off is reduced coverage and roaming capability in areas that rely on legacy radio access. Carriers and enterprise mobile operators can add network-side rogue-cell and abnormal-cell-ID detection/blocking and, for managed fleets, restrict devices to an approved cell/PLMN allowlist; this reduces exposure but requires coordination with the mobile network operator and can interfere with legitimate roaming and emergency access. Rebooting an affected UE after a suspected attack restores modem service, since the impact is limited to a denial-of-service condition.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-126 buffer over-read in the modem component of MediaTek chipsets: a bounds check is missing when processing a malformed modem-layer message, so the firmware reads past the end of an allocated buffer. The attack path is over-the-air rather than TCP/IP - the attacker must operate a rogue base station (a fake eNB/gNB) within radio range and induce the victim UE to attach to it, after which the crafted message reaches the modem's message parser. That adjacency requirement is reflected in the CVSS vector's AV:A (adjacent network), while AC:H captures the physical proximity, the need for cellular test/rogue-cell equipment, and the difficulty of reliably coercing a modern UE to camp on an untrusted cell; PR:N and UI:N mean no credentials or user action are needed once the device is attached. Impact is strictly availability (A:H with C:N/I:N), i.e., modem crash or instability rather than memory disclosure or control-flow hijack, which is consistent with the associated tags (Buffer Overflow, Denial Of Service) and with SSVC's 'partial' technical impact and 'no' automatable rating. The missing-bounds-check class is well understood and typically remediated by adding explicit length validation before the read in the affected parsing routine.
Know when Mt2735 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:A and AC:H because exploitation requires a rogue base station and victim attachment within radio range; PR:N/UI:N per description; A:H only, as impact is denial of service with no confidentiality or integrity loss.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8913.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek Modem OOB and Memory Corruption Flaws
View all 11More in Mt2735 Firmware
View allAn out-of-bounds read/write flaw in MediaTek's ccci (cross-core/modem control) component allows an authenticated local a
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Exploit-DB