EUVD-2026-40871
GHSA-v5qh-c8xh-h5f9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeploy rogue base station near target
-
DeliveryInduce UE to camp on cell
-
ExploitSend crafted radio-layer message
-
ExecutionTrigger out-of-bounds write in modem
-
PersistCorrupt baseband memory
-
ImpactEscalate privilege within modem
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target UE to connect to a rogue base station controlled by the attacker (an adjacent, radio-range position - AV:A), meaning the attacker needs cellular transmission equipment and physical proximity, and typically must lure or force the device onto the malicious cell. Per the CVSS vector, no privileges (PR:N) and no user interaction (UI:N) are needed once the device is connected, so exploitation is unauthenticated against affected MediaTek modem firmware. The limiting factors are the high attack complexity (AC:H) reflecting the rogue-base-station setup and the requirement that the victim device camp on the attacker's cell, plus applicability only to the enumerated MediaTek chipsets running unpatched (pre-July-2026) modem firmware. |
| Impact | The CVSS 3.1 base score is 7.5 (High) with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: the adjacent (radio-range) attack vector and high attack complexity are the main limiting factors, offset by no privileges and no user interaction being required, and full high impact to confidentiality, integrity, and availability of the modem. The high complexity reflects a real precondition - the victim device must connect to a rogue base station the attacker controls - requiring physical radio proximity and equipment (e.g., an SDR/false cell), which makes this suited to targeted rather than opportunistic mass attacks. No EPSS score was provided in the input, there is no KEV listing, and no known POC, so the practical exploitation signals are currently weak despite the serious technical impact. This is a credible priority for high-value/high-risk targets and for OEMs shipping affected silicon, but the proximity requirement and absence of public exploit code place it below internet-exposed unauthenticated RCE in triage urgency. |
| Exploit ScenarioDerived | An attacker sets up a rogue LTE/5G base station near a target and induces the victim's phone to camp on it, then transmits a crafted radio-layer message that overflows a buffer in the MediaTek modem due to the missing bounds check, corrupting modem memory to escalate privileges within the baseband without any user action. Because attack complexity is high and the vector is adjacent, this is a proximity-based, targeted attack rather than remote internet exploitation; no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a rogue base station to corrupt modem memory via a missing bounds check (out-of-bounds write, CWE-787). Once a target UE camps on the attacker-controlled cell, exploitation requires no user interaction and no pre-existing privileges, potentially yielding privilege escalation within the modem subsystem. Tracked in MediaTek's July 2026 Product Security Bulletin (Patch ID MOLY01402160); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the MediaTek fix identified as Patch ID MOLY01402160 (Issue ID MSV-7298) as delivered through your device OEM's firmware/security update; this is best described as 'Patch available per vendor advisory' since the July 2026 MediaTek Product Security Bulletin (https://corp.mediatek.com/product-security-bulletin/July-2026) does not publish a single tagged firmware version number, and device availability depends on each OEM's rollout. Until the modem firmware update reaches a given device, practical compensating controls target the rogue base station prerequisite: where supported, disable 2G/legacy-radio fallback and enable carrier-managed or device-level protection against downgrade/false base stations, which reduces exposure but can break connectivity in areas with only legacy coverage; advise high-risk users to use airplane mode or Wi-Fi-only in untrusted physical locations, at the cost of cellular reachability. There is no host-side configuration that fully removes the baseband code path, so firmware patching is the only complete remediation. Track OEM security bulletins and confirm the July 2026 patch level is installed via the device's Android security patch/update screen.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the cellular baseband (modem) stack that runs on MediaTek's MT-series application/modem SoCs, which handle the LTE/5G radio protocol layers beneath the Android OS. CWE-787 (out-of-bounds write) indicates that attacker-influenced data received over the air is processed without proper length or bounds validation, letting a write run past the intended buffer and corrupt adjacent modem memory. Because the vulnerable code path executes on the modem's isolated processor rather than the Android application processor, exploitation targets a trust boundary that sits below the OS. The CPE (cpe:2.3:a:mediatek,_inc.:mediatek_chipset) and the EUVD list enumerate a broad range of affected parts spanning low-end (e.g., MT6739, MT6761), mainstream (MT6768, MT6789), and flagship-class (MT6983, MT6985, MT6989, MT6990, MT6991) chipsets, plus MT87xx/MT88xx families used in tablets and other devices.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent radio vector (AV:A) with high complexity (AC:H) for the rogue-base-station precondition; no privileges or interaction needed, full high impact confined to the modem subsystem.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01402160; Issue ID: MSV-7298.
Executive ViewAI
A vulnerability in MediaTek baseband firmware used across millions of smartphones and IoT devices enables remote compromise via rogue cellular networks, requiring no user action. Organizations with employee mobile fleets, customer-facing mobile applications, or cellular IoT deployments face data breach and service disruption risks. No patch is currently available, leaving device populations unprotected while vendors develop fixes.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy mobile threat detection platforms capable of identifying rogue base station connections and anomalous modem behavior; (2) Disable 2G/3G connectivity on supported devices to reduce attack surface where 4G/5G service is available; (3) Coordinate with device OEMs and carriers for independent modem firmware updates and patch release timelines; (4) Monitor carrier and threat intelligence feeds for exploitation indicators; (5) Implement user awareness in high-risk geographies regarding untrusted network connections.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in MediaTek Modem Remote DoS and Privilege Escalation
View all 6More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to
Exploit-DB