EUVD-2026-40870
GHSA-r5cc-gr9f-ch8c
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent vector and high complexity reflect mandatory rogue base station infrastructure; PR:N and UI:N confirmed by description; availability-only impact matches DoS-only null pointer dereference with no scope change.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01826924; Issue ID: MSV-7301.
AnalysisAI
Remote denial of service in the MediaTek Modem firmware component affects approximately 60 chipset models via a null pointer dereference triggered when a target device connects to a rogue cellular base station. An attacker controlling a fake eNodeB or gNodeB can transmit crafted modem protocol messages that cause improper input validation to fail, crashing the modem and stripping affected devices of cellular connectivity. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation status as none, indicating this remains a theoretical but technically feasible threat for well-resourced actors.
Technical ContextAI
The vulnerability resides in the Modem firmware stack running on MediaTek cellular chipsets (cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*). CWE-476 (NULL Pointer Dereference) identifies the root cause: the modem's input-processing routines fail to validate incoming radio-layer protocol messages before dereferencing pointers derived from attacker-controlled data. When a user equipment (UE) - such as a smartphone - camps on a rogue base station, the attacker can inject malformed LTE or 5G NR signaling messages that reach the modem layer unchecked. The CVSS adjacent vector (AV:A) is technically accurate because exploitation is constrained to the radio-layer physical adjacency model: the attack does not traverse standard IP routing but instead abuses the cellular protocol stack's trust in the serving base station. High attack complexity (AC:H) in the CVSS vector reflects the non-trivial infrastructure requirement of operating a functional rogue base station capable of luring UE attachment.
RemediationAI
The primary remediation is to apply the vendor-released patch identified as Patch ID MOLY01826924 (Issue ID MSV-7301), distributed through MediaTek's July 2026 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/July-2026. Patch status is confirmed per vendor advisory, though an exact patched modem firmware version number is not independently verifiable from available references beyond the patch identifier. OEMs and ODMs must integrate this modem patch into their device firmware and distribute over-the-air updates to end users promptly. For users on devices without an available OEM patch, compensating controls are constrained by the nature of the attack: disabling mobile data or enabling airplane mode in environments where rogue base station activity is suspected will prevent modem exposure but eliminates cellular functionality entirely. Enterprise environments operating in sensitive facilities may consider deploying commercial rogue base station detection systems (IMSI catcher detectors) to identify malicious cell infrastructure before devices connect. There are no known software-level workarounds that preserve cellular functionality while mitigating this vulnerability.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today