Windows Mobile Broadband CVE-2026-70579

The target system must have a Mobile Broadband (WWAN/cellular LTE or 5G) adapter physically installed and a mobile broadband connection active at the time of attack. The attacker must be positioned on the cellular network path - options include operating a rogue base station in radio range, control of or access to mobile carrier infrastructure, or injection of malformed data at a cellular protocol layer. Devices using only Wi-Fi or Ethernet without WWAN hardware are not exposed. Per CVSS PR:N and UI:N, no authentication and no user interaction are required once network positioning is achieved. The cellular radio-layer positioning requirement is the primary limiting factor relative to conventional AV:N vulnerabilities, as it demands physical-layer infrastructure access or proximity.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) signals high-confidence unauthenticated network exploitation with significant confidentiality impact but no integrity or availability impact. Real-world exploitability is constrained by the cellular attack surface: the attacker must be positioned on the cellular network path - either operating as a rogue base station, embedded within mobile carrier infrastructure, or able to inject malformed WWAN protocol packets. This physical-layer proximity requirement is not reflected in AV:N, which may overstate ease of access compared to conventional IP-network vulnerabilities. No EPSS score is available in the input data. No KEV listing and no public exploit code reduces urgency relative to the CVSS score. Organizations with mobile-broadband-equipped laptops in high-sensitivity environments (government, financial) should treat this as elevated priority due to rogue base-station feasibility in those threat models.

An attacker operating a rogue cellular base station or with access to mobile carrier infrastructure sends specially crafted malformed WWAN protocol frames to a Windows laptop with an active Mobile Broadband connection. The Windows Mobile Broadband driver processes the packet and performs an out-of-bounds read, returning adjacent kernel memory contents in a protocol response. The attacker captures the leaked memory, potentially recovering sensitive data such as credentials or cryptographic material resident in kernel address space. No public POC is available at time of analysis.