EUVD-2026-19566Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (MediaTek) · only source for this CVE.
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01406170; Issue ID: MSV-4461.
AnalysisAI
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment connects to an attacker-controlled rogue cellular base station. Affects 57 MediaTek chipset models across MT67xx, MT68xx, MT69xx, MT87xx, and MT27xx families used in mobile devices. Authentication not required (CVSS PR:N) but requires adjacent network access and user interaction to connect to malicious base station. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis, though vendor patch MOLY01406170 has been released per April 2026 MediaTek security bulletin.
Technical ContextAI
This vulnerability resides in the modem firmware layer of MediaTek chipsets, specifically in cellular baseband processing components that handle communication protocol stacks for mobile networks (LTE/5G). The CWE-787 out-of-bounds write occurs due to missing bounds validation when processing data from cellular base stations, allowing buffer overflow conditions. The affected CPE identifier cpe:2.3:a:mediatek,_inc.:mediatek_chipset encompasses modem implementations across flagship (MT69xx), mid-range (MT68xx), and automotive/IoT (MT87xx) product lines. The modem subsystem operates at high privilege levels with direct hardware access, making memory corruption vulnerabilities particularly severe. The adjacent network attack vector (AV:A) indicates exploitation requires the attacker to operate within radio frequency range of the target device, effectively positioning a rogue base station that masquerades as legitimate cellular infrastructure to trigger the vulnerability during protocol negotiation or data handling phases.
RemediationAI
Apply vendor-released patch MOLY01406170 as documented in MediaTek Product Security Bulletin April 2026 available at https://corp.mediatek.com/product-security-bulletin/April-2026. Device manufacturers (OEMs) integrating affected MediaTek chipsets must incorporate this modem firmware update into their device software packages and distribute through normal update channels. End users should install security updates provided by their device manufacturer as soon as available, checking Settings > System > System Update or equivalent paths depending on Android OEM implementation. Organizations managing mobile device fleets should prioritize devices with affected chipsets for firmware updates through mobile device management platforms. As interim risk mitigation while awaiting patches, organizations with high-security requirements may implement network monitoring to detect rogue base station activity using cellular network analysis tools, though this provides limited protection and does not address the underlying vulnerability. Disabling automatic network selection and manually selecting trusted carriers reduces but does not eliminate exposure to rogue base station attacks.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today