EUVD-2026-92180
GHSA-xph5-44g7-gggh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged local code execution on device
-
ExploitInteract with vulnerable modem interface
-
ExecutionTrigger logic error in modem handling
-
ImpactRead disclosed sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Debug information protection
|
| Exploitation Conditions | Exploitation requires local access to a device built on an affected MediaTek chipset (80+ models listed, e.g., MT6983, MT6895, MT6989, MT6768) and a baseline low privilege level (PR:L) - typically an installed or compromised app running with ordinary, non-root permissions that can reach the modem interface. No user interaction is required and no privilege escalation beyond that baseline is needed. Limiting factors: the attacker must already have local code execution on the device (no remote/network vector), the impact is confined to confidentiality (information disclosure only, no code execution or device compromise), and only MediaTek-based devices on unpatched modem firmware prior to patch MOLY01645293 are affected. |
| Impact | This is a moderate-severity local information disclosure in MediaTek Modem firmware, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and classed as CWE-215 (information exposure through debug information). The CVSS vector is internally consistent with the description: local attack vector (AV:L) matches 'local information disclosure,' PR:L matches 'no additional execution privileges needed' (i.e., some baseline low privilege is still required, not none), and UI:N matches 'user interaction is not needed.' Impact is confidentiality-only and high (C:H/I:N/A:N). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Because exploitation requires local access plus low privileges on the device and yields disclosure only (no code execution, integrity, or availability impact), this is a real but lower-tier priority rather than an urgent, remotely-weaponizable flaw - it is best treated as a patch-in-normal-cycle issue, with the caveat that the extremely broad MediaTek chipset footprint raises aggregate exposure. Note that PR:L indicates authenticated/local-privilege exploitation; the phrase 'no additional execution privileges needed' refers to not escalating beyond that baseline, not to unauthenticated access. |
| Exploit ScenarioDerived | A malicious or compromised low-privileged app already running on a MediaTek-based Android device interacts with the modem interface and, due to a logic error, is served sensitive information it should not have access to (e.g., debug or memory contents per CWE-215). No user interaction and no privilege escalation beyond the app's existing permissions are required. No public proof-of-concept is identified in the available data, so exploitation would require local reverse-engineering of the modem logic. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, including MT6983, MT6895, MT6989, and MT6768, when running unpatched modem firmware. A local app with ordinary low privileges (PR:L) can access sensitive modem debug information without user interaction, yielding high confidentiality impact but no code execution or integrity/availability loss; CVSS is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation, but MediaTek patch MOLY01645293 and the October 2026 product security bulletin address the flaw.
RemediationAI
Apply the vendor fix by updating device firmware through the OEM to a build containing MediaTek patch MOLY01645293, as referenced in the MediaTek October 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/October-2026). Because the issue is in modem firmware, users cannot patch independently; they must wait for OEM/carrier updates for their specific device model. Until a patched build is available, compensating controls are limited and local-only: restrict installation of untrusted or sideloaded apps, remove unnecessary apps that could interact with modem interfaces, enforce mobile device management policies that prevent sideloading and keep OS/modem firmware updated, and avoid granting sensitive permissions to untrusted applications. These controls reduce the attack surface but do not fully mitigate the flaw because any locally installed app with ordinary privileges on an unpatched device may still trigger the information disclosure. No remote workaround exists.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in MediaTek modem firmware and is classified as CWE-215 (Insertion of Sensitive Information Into Debugging Code), meaning a logic error causes sensitive debug or diagnostic data to be exposed rather than merely a generic memory-safety bug. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N shows the attack is local (AV:L), requires low privileges (PR:L), needs no user interaction (UI:N), and impacts only confidentiality (C:H); integrity and availability are unaffected. Exploitation requires an attacker to already have local code execution or an installed/compromised app on a device using an affected MediaTek chipset, and then reach the modem interface to read information that should be protected. The EUVD advisory lists over 80 impacted MediaTek chipsets and no CPE strings were supplied in the input data.
Know when Mt2735 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector and low privilege (an installed app) per 'local' and 'no additional execution privileges needed'; UI:N as stated; confidentiality-only high impact, no integrity or availability effect.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01645293; Issue ID: MSV-6761.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in MediaTek Modem OOB and Memory Corruption Flaws
View all 11More in Mt2735 Firmware
View allAn out-of-bounds read/write flaw in MediaTek's ccci (cross-core/modem control) component allows an authenticated local a
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Exploit-DB