MediaTek Modem EUVD-2026-72193

Exploitation requires local access and user-level execution privileges (PR:L per CVSS vector) on a device running one of the 22 affected MediaTek chipsets. The vulnerability description states that user interaction is needed for exploitation, suggesting a victim must trigger a specific action (such as running a malicious app), though the CVSS vector lists UI:N - this discrepancy has not been resolved by the vendor advisory and should be clarified. The attack vector is strictly local (AV:L); no remote exploitation path exists. There is no confidentiality or integrity impact. No special modem configuration or elevated permission beyond user-level execution is required, but the attack surface is limited to devices running the specific chipset models listed.

Real-world risk is moderate-to-low. The CVSS 5.5 score is consistent with a local, availability-only impact with no confidentiality or integrity consequence. The SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) corroborates this: no exploitation in the wild has been observed, the attack cannot be automated remotely, and impact is partial rather than total. A noteworthy discrepancy exists between the CVSS vector (UI:N) and the vulnerability description, which explicitly states user interaction is required; this inconsistency should be verified against the vendor bulletin before concluding that no user interaction is needed. The local attack vector and low-privilege requirement mean that exploitation is bounded to processes already running on the device, reducing risk further. Even routine patch management - the kind any organization managing a device fleet would conduct - is sufficient to address this.

A malicious Android application running with standard user-level privileges on a device with an affected MediaTek chipset crafts a specific input directed at the modem component, causing a firmware crash and triggering a system reboot or loss of cellular connectivity. The attack requires that the user run or interact with the malicious application, consistent with the description's note that user interaction is needed. No public exploit code has been identified.