EUVD-2026-26890Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01753620; Issue ID: MSV-6100.
AnalysisAI
Remote denial of service in MediaTek modem firmware across 47+ chipset variants allows attackers to crash the modem via incorrect error handling when a user equipment device connects to a rogue base station, requiring no authentication or user interaction. The vulnerability affects a broad range of MediaTek cellular chipsets (MT6855, MT6985, MT8793, and others) and carries a CVSS 6.5 score reflecting network-adjacent attack vector and high availability impact. Patch MSV-6100 / MOLY01753620 is available from MediaTek.
Technical ContextAI
The vulnerability resides in the modem firmware's radio access network (RAN) stack, specifically in the handling of malformed or unexpected protocol messages from base station connections. CWE-617 (Reachable Assertion) indicates the root cause is an assertion or validation check that can be triggered to cause a crash when the modem receives crafted signals or control messages from a rogue base station. The attack vector is adjacent (AV:A) rather than purely network because the modem must be in active communication with the attacker-controlled base station; however, any device in cellular coverage of such a station is at risk. The issue affects MediaTek's modular chipset design, which powers Android devices, IoT equipment, and telecommunications infrastructure globally. CPE data confirms the vulnerability spans multiple modem architecture families (Helio, Dimensity, and other MediaTek lines).
RemediationAI
Apply MediaTek firmware patch MOLY01753620 (Patch ID MSV-6100) released in May 2026 via the standard OTA update mechanism for devices using affected chipsets. End users should enable automatic system updates and contact their device manufacturer (Samsung, Xiaomi, OPPO, Vivo, Qualcomm reference designs, telecom vendors) for specific firmware version numbers that include this fix, as MediaTek patch identifiers map to vendor-specific release versions. For infrastructure operators (cellular carriers, private network operators), coordinate with MediaTek and equipment vendors for modem firmware updates to enterprise gateways and base station equipment. No workaround exists to prevent the crash other than avoiding connection to untrusted networks, which is impractical for mobile devices. The modem will automatically reconnect after crash, resulting in brief service interruption but not data loss. Apply patches as part of regular maintenance windows rather than emergency response, given the low exploitation likelihood (EPSS 0.08%) and non-critical impact.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today