EUVD-2026-115054
GHSA-fmr9-9m5w-7cgx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeploy rogue base station in radio range
-
DeliveryInduce target UE to attach
-
ExploitSend crafted modem protocol message
-
ExecutionTrigger out-of-bounds read in baseband
-
ImpactCrash modem causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim UE has already connected to a rogue (attacker-controlled) base station - i.e., the attacker must operate fake cellular radio infrastructure within range and get the target device to camp on it; this is an adjacent-network (AV:A) radio-proximity attack, not an Internet-remote one. Once connected, no authentication (PR:N) and no user interaction (UI:N) are needed, and the result is denial of service of the modem only (no code execution, no data compromise). The limiting factors are the high attack complexity (AC:H) of standing up the rogue base station and luring/forcing the device onto it, the requirement for radio-range proximity, and that impact is confined to availability. |
| Impact | This is a moderate, conditional-risk issue rather than a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.3 MEDIUM) describes an adjacent-network (radio-range) attack with high attack complexity, no privileges and no user interaction, resulting in availability-only impact - a denial of service of the modem/baseband. The high complexity is grounded in the described precondition: the victim UE must first connect to an attacker-controlled rogue base station, which the attacker must stand up and lure the device onto. No EPSS score was provided in the input, the vulnerability is NOT on the CISA KEV list, and no exploit or PoC reference is present, so there is no evidence of active exploitation. The vuln.today decision label is 'this_month' (routine prioritization, not act_now/emergency), which aligns with a medium-severity, availability-only flaw that requires a non-trivial attacker setup. One cross-source tension to verify: the Tags include 'Information Disclosure', but the CVSS vector sets C:N (no confidentiality impact) and the description states the OOB read leads only to denial of service - treat the DoS/availability framing (confirmed by vendor description and CVSS) as authoritative over the generic 'Information Disclosure' tag. |
| Exploit ScenarioDerived | An attacker operating a rogue/fake base station within radio range entices a nearby MediaTek-powered device to attach to it, then sends a crafted cellular protocol message that triggers an out-of-bounds read in the modem, crashing the baseband and denying cellular service. No authentication or user interaction is required once the UE has connected, but the attacker must deploy rogue radio infrastructure and get the target to camp on it (AV:A, AC:H). No public exploit or PoC reference was provided in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
An out-of-bounds read in the MediaTek modem firmware of a broad range of MediaTek chipsets (MT27xx, MT68xx, MT69xx, MT86xx, MT87xx, MT88xx and MT89xx families) allows an attacker operating a rogue base station to crash or destabilize the modem of any UE that camps on it, producing a denial of service. The flaw is a missing bounds check (CWE-125) reachable over the cellular radio interface with no authentication and no user interaction, although the attacker must first stand up fake radio infrastructure within range and get the target device to attach to it, which is why the vector is scored AV:A/AC:H and severity is moderate at 5.3. Impact is confined to availability - no code execution and no data compromise - and no public exploit code has been identified at time of analysis; MediaTek has issued fix patch IDs MOLY01349680 and MOLY01369097 (issue MSV-9364) through its November 2026 product security bulletin, and the issue is prioritized for remediation this month rather than as an emergency.
RemediationAI
MediaTek has released modem firmware fixes tracked as patch IDs MOLY01349680 and MOLY01369097 under issue MSV-9364, published in the November 2026 MediaTek product security bulletin (https://www.mediatek.com/product-security-bulletin/November-2026). Because the affected component is modem firmware inside a chipset, the fix is not installable directly by end users: it must be integrated by the device OEM or carrier and delivered as a device firmware/OTA update, so asset owners should map their inventory against the chipset list above and request builds containing those patch IDs from their device vendors. No workaround, configuration change or feature toggle is documented in the available sources; until a patched build is available for a given device, the residual exposure is limited to situations where the device has attached to an attacker-controlled base station in radio proximity, and the vendor-published fix should be treated as the only complete remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in cellular modem firmware shipped as part of MediaTek's chipset platforms, which handle the non-access-stratum and radio-resource-control signalling exchanged with the network. CWE-125 (out-of-bounds read) arises here because a length or index field carried in attacker-influenced signalling is consumed without a bounds check, so the modem reads past the end of its buffer. Because the attacker is a rogue base station, the malicious input arrives over the air after the device has attached to the attacker's cell; nothing about the exchange requires credentials or user confirmation, matching the PR:N/UI:N elements of the CVSS vector. The AV:A/AC:H scoring reflects the practical prerequisite of deploying a fake base station within radio range and inducing the UE to camp on it, and the C:N/I:N/A:H impact reflects that the observable effect is a modem-side denial of service rather than memory corruption leading to code execution. Public reporting tags the issue as involving buffer handling, denial of service and possible information disclosure, but the authoritative assessment treats availability impact as the realized outcome.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Radio-proximity rogue-base-station precondition gives AV:A and AC:H; no auth or interaction needed (PR:N/UI:N); DoS-only modem crash means C:N/I:N/A:H.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01349680 / MOLY01369097; Issue ID: MSV-9364.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Missing permission checks in the MediaTek GPU pdma driver, paired with a use-after-free, allow local privilege escalatio
Out-of-bounds write in the MediaTek modem component allows code that is already running locally on an affected device to
Local privilege escalation in the GPU pdma path of MediaTek MT8910 and MT6993 chipsets allows an unprivileged local proc
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Local privilege escalation in the MediaTek GPU pdma kernel driver allows a process already running with user-level privi
Exploit-DB