EUVD-2026-114934
GHSA-vmxx-jr8q-5f47
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOperate attacker-controlled rogue base station
-
DeliveryInduce victim UE to attach
-
ExploitDeliver malformed input to modem ip_stack
-
ExecutionTrigger out-of-bounds read (CWE-125)
-
ImpactCrash modem for remote denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to operate a rogue cellular base station and get the victim's UE (the MediaTek-chipset device) to connect to it - the flaw is reachable only over the air interface once that attachment occurs, which is why the vector is adjacent (AV:A) and high-complexity (AC:H). No authentication (PR:N) and no user interaction (UI:N) are required once the device is attached. Limiting factors that reduce realistic risk: the attacker must be within radio proximity and successfully impersonate/induce attachment to a rogue base station, and the impact is confined to denial of service (modem crash) with no confidentiality or integrity effect. Affected products are specific MediaTek chipset models (e.g. MT6897, MT6989, MT6991, MT6983 and others listed), so only devices built on those chipsets running unpatched modem firmware are exposed. |
| Impact | This is a moderate-severity issue (CVSS 5.3) whose real-world risk is substantially constrained by its preconditions. The CVSS vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H tells a consistent story: the attack is adjacent (AV:A), not network-reachable over the internet, requires high attack complexity (AC:H), needs no authentication (PR:N) and no user interaction (UI:N), and its only impact is availability (A:H) - no confidentiality or integrity loss, which aligns with an out-of-bounds read (CWE-125) that triggers a crash rather than leaking or altering data. The description confirms the key limiting factor: exploitation requires the victim UE to have connected to a rogue base station controlled by the attacker, which is what justifies AV:A and AC:H. EPSS is not provided in the input, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV, and there is no public exploit identified at time of analysis - the vuldb and NVD/EUVD references are advisories, not proof-of-concept code. The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a patch-on-normal-cycle issue. One minor signal conflict: the input Tags include 'Information Disclosure', but the authoritative CVSS impact metrics are C:N/I:N (availability-only), so the information-disclosure characterization is not supported by the scored impact and should not be treated as confirmed. Net: a genuine but lower-priority modem-stack DoS, gated behind the significant operational hurdle of standing up a rogue base station in radio range of the target. |
| Exploit ScenarioDerived | An attacker sets up a rogue cellular base station within radio range of a target device and induces the victim's UE to attach to it. The attacker then sends crafted/malformed input to the MediaTek modem's ip_stack, triggering an out-of-bounds read that crashes the modem and causes a remote denial of service against the device's connectivity. No public exploit code is identified at time of analysis, and the specific triggering input is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
An out-of-bounds read in MediaTek's modem ip_stack can crash the modem and cause denial of service on devices built with affected MediaTek chipsets (including MT6897, MT6989, MT6991 and MT6983) when the victim UE connects to an attacker-controlled rogue base station. Exploitation requires radio proximity and successful over-the-air attachment, but no authentication or user interaction once attached; impact is assessed as availability-only (C:N/I:N/A:H). No public exploit code was identified at time of analysis, and the CVSS 5.3 rating reflects the substantial rogue-base-station precondition.
RemediationAI
Apply the MediaTek modem firmware patch identified as MOLY01387180 (Issue MSV-5152) through the device OEM or carrier; MediaTek's November 2026 product security bulletin at https://www.mediatek.com/product-security-bulletin/November-2026 is the authoritative source. Because this is chipset/modem firmware, the update must be delivered by the device vendor rather than installed by the end user, and no user-level workaround is stated in the available sources. The exposure precondition is attachment to an attacker-controlled rogue base station, so until the OEM firmware update is available, risk reduction depends on preventing or detecting such attachment; this is not a substitute for the vendor patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-125 (out-of-bounds read) in the modem's IP stack, reachable over the cellular air interface. The CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset identifies the affected platform class as MediaTek chipsets; EUVD lists specific models such as MT6897, MT6878, MT6993, MT6855, MT6877, MT6983 and many others. The trigger is not described in the available sources beyond 'improper input validation,' so the exact malformed over-the-air input is not confirmed. The assessed vector - AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - means the attacker must be adjacent (operate a rogue base station within radio range) and overcome high complexity to get the UE to attach, after which no privileges or user action are needed; the assessed effect is a modem crash/denial of service, with no confidentiality or integrity impact confirmed despite the out-of-bounds-read class and information-disclosure tag.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent radio access via a rogue base station (AV:A), the rogue-base-station precondition drives AC:H, no auth or interaction (PR:N/UI:N), and the out-of-bounds read yields availability-only impact (C:N/I:N/A:H).
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01387180; Issue ID: MSV-5152.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Missing permission checks in the MediaTek GPU pdma driver, paired with a use-after-free, allow local privilege escalatio
Out-of-bounds write in the MediaTek modem component allows code that is already running locally on an affected device to
Local privilege escalation in the GPU pdma path of MediaTek MT8910 and MT6993 chipsets allows an unprivileged local proc
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Local privilege escalation in the MediaTek GPU pdma kernel driver allows a process already running with user-level privi
Exploit-DB