EUVD-2026-19568Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSet up rogue base station
-
DeliveryUE connects to malicious network
-
ExploitSend crafted modem protocol message
-
ExecutionTrigger out-of-bounds write in modem parser
-
ImpactEscalate privilege to system level
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | UE must connect to attacker-controlled rogue base station. Exploitation occurs through malicious modem protocol messages during connection establishment. No authentication or special user privileges required, but physical proximity or cellular network control needed for rogue base station operation. |
| Impact | Real-world exploitation risk is moderate despite the 8.8 CVSS score. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N indicates unauthenticated adjacent network access with low complexity, but the SSVC framework contextualizes this: exploitation status is 'none', not automatable, yet yields total technical impact (arbitrary code execution in modem context). The 0.06% EPSS score (18th percentile) reflects significant practical barriers-attackers must deploy specialized Software-Defined Radio (SDR) equipment costing thousands of dollars, position it within cellular range of targets, configure it to impersonate legitimate carriers, and induce victim devices to camp on the rogue base station. No public exploit code exists and no confirmed active exploitation (CISA KEV) at time of analysis. However, nation-state actors and advanced persistent threat groups have demonstrated rogue base station capabilities (IMSI catchers, Stingrays). The widespread deployment across 63 chipset variants in consumer smartphones, tablets, and IoT devices creates a large attack surface. Organizations in high-threat environments (government, critical infrastructure, defense contractors) should prioritize patching due to the privilege escalation outcome and difficulty of detection. For general enterprise deployments, the specialized attack requirements and low EPSS probability suggest medium priority behind actively exploited vulnerabilities. |
| Exploit ScenarioDerived | An attacker deploys a Software-Defined Radio (SDR) configured as a rogue LTE or 5G base station near a target location such as a corporate campus, government facility, or public venue. The rogue base station advertises stronger signal strength than legitimate carriers, causing nearby MediaTek-equipped smartphones to perform cell selection and camp on the attacker's infrastructure. Once the victim device establishes a connection, the attacker sends specially crafted cellular protocol messages (potentially in |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 07, 2026
Out-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-controlled rogue cellular base stations. The vulnerability affects over 60 MediaTek chipset models widely deployed in smartphones and IoT devices, exploitable by adjacent network attackers without authentication (CVSS:3.1 AV:A/PR:N). While EPSS scores this at only 6% exploitation probability (18th percentile) and no active exploitation is confirmed at time of analysis, the attack s
Earlier versions of this analysis (1)
Out-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-controlled rogue cellular base stations. The vulnerability affects over 60 MediaTek chipset models widely deployed in smartphones and IoT devices, exploitable by adjacent network attackers without authentication (CVSS:3.1 AV:A/PR:N). While EPSS scores this at only 6% exploitation probability (18th percentile) and no active exploitation is confirmed at time of analysis, the attack scenario requires specialized radio equipment and victim proximity to malicious infrastructure. Patch ID MOLY01088681 addresses the missing bounds check in modem baseband code.
RemediationAI
MediaTek released firmware patch MOLY01088681 addressing the modem bounds check vulnerability, documented in their April 2026 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/April-2026. End users cannot directly apply MediaTek patches; device manufacturers (Samsung, Xiaomi, Oppo, Vivo, Realme, and others) must integrate the modem firmware fix into OEM-specific system updates. Users should immediately check for and install the latest security updates from their device manufacturer, prioritizing devices used in sensitive environments. OEMs should expedite integration of MOLY01088681 into monthly security maintenance releases. For enterprise deployments, Mobile Device Management (MDM) administrators should enforce automatic security updates and verify patch deployment across managed device fleets. As a partial mitigation until patches deploy, organizations can implement network policies restricting device roaming in high-risk geographic areas, though this does not prevent determined attackers with portable rogue base stations. Security teams should monitor for anomalous cellular behavior including unexpected base station connections, signal strength anomalies, or devices repeatedly losing and re-establishing network registration, though sophisticated attacks may not produce detectable signatures.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability resides in the MediaTek modem baseband processor firmware, specifically in code handling cellular network communications. The root cause is CWE-787 (Out-of-bounds Write), where the modem fails to validate buffer boundaries when processing data from cellular base stations. MediaTek chipsets integrate modem, application processor, and connectivity functions on a single SoC; the affected modem component operates at high privilege levels with direct hardware access. The vulnerability spans 63 distinct chipset models including flagship (MT6989, MT6990, MT6991), mid-range (MT6833, MT6877, MT6985), and specialized IoT variants (MT2735, MT2737, MT8668-MT8893 series). The CVSS vector AV:A (Adjacent Network) reflects the cellular radio attack surface, requiring the attacker to operate a rogue base station within radio range of victim devices. The missing bounds check allows malicious Over-The-Air (OTA) cellular protocol messages to write beyond allocated memory buffers during protocol stack processing, potentially corrupting modem firmware memory structures.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01088681; Issue ID: MSV-4460.
Executive ViewAI
CVE-2026-20433 is a high-severity remote privilege escalation affecting over 60 MediaTek chipset models in smartphones and IoT devices through out-of-bounds memory writes when connecting to rogue cellular base stations. This vulnerability poses significant risk to device security and data confidentiality across a broad installed base, though exploitation requires adjacent network positioning and specialized radio equipment, limiting immediate threat scope.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation to isolate critical devices from untrusted cellular connections where feasible; mobile device management (MDM) policies restricting automatic connection to unfamiliar networks; carrier-level monitoring for suspicious base station activity; and consideration of temporary restrictions on sensitive transactions on affected devices in high-threat environments pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in Modem Out of Bounds Write Vulnerabilities
View all 2More in Mediatek Chipset
View allHeap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to
GitHub PoC
Exploit-DB