EUVD-2026-92182
GHSA-3hgh-w6pp-p4rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeploy rogue base station near target
-
DeliveryInduce victim UE to attach
-
ExploitSend crafted modem signaling message
-
ExecutionTrigger out-of-bounds read in baseband
-
ImpactCrash modem causing loss of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
|
| Exploitation Conditions | Exploitation requires the victim handset (UE) to have connected to a rogue base station controlled by the attacker - i.e., the attacker must operate attacker-controlled cellular radio infrastructure and get the target device to attach/camp on it over the adjacent (AV:A) radio interface. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the rogue-cell precondition plus required RF proximity is precisely why CVSS marks AC:H. Limiting factors for defenders: the attack is proximity-bound and cannot be launched from arbitrary remote networks; it only affects the listed MediaTek chipsets running unpatched modem firmware; and impact is confined to availability (modem DoS/crash) with no data exposure or code execution. |
| Impact | This is a moderate-severity, low-real-world-priority issue despite the attention MediaTek baseband bugs attract. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.3) tells a coherent story: exploitation is over the adjacent radio interface (AV:A), requires no authentication (PR:N) or user interaction (UI:N), but carries HIGH attack complexity (AC:H) because the attacker must stand up a rogue base station AND induce the victim UE to attach to it. Impact is availability-only (A:H, C:N/I:N) - consistent with an out-of-bounds read (CWE-126) causing a modem denial of service rather than code execution; the description explicitly states 'no additional execution privileges needed' and 'remote denial of service,' so this is NOT an RCE. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AC:H plus the physical/RF precondition (operating a rogue cell and getting a target to camp on it) make opportunistic mass exploitation impractical; realistic abuse is targeted and proximity-based. Note the tag 'Buffer Overflow' is imprecise - the CWE (126, Buffer Over-read) and the description ('out of bounds read') indicate an over-READ, not a classic overflow; treat the tag as approximate. |
| Exploit ScenarioDerived | An attacker deploys a rogue cellular base station near a target and broadcasts a signal strong enough that a nearby MediaTek-powered device camps onto it. The rogue station then sends crafted signaling that triggers a missing permission check and an out-of-bounds read in the modem firmware, crashing the baseband and denying cellular service to the victim. No public exploit code was identified in the provided data, and the high attack complexity and physical proximity requirement limit this to targeted use. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, producing a remote denial of service on affected handsets. The attack is unauthenticated (CVSS PR:N) and requires no user interaction (UI:N), but it only succeeds if the victim UE is already camped on a rogue base station the attacker controls, which is why the vector is scored AV:A/AC:H and the issue is assessed as moderate severity and low real-world priority. No public exploit code has been identified at the time of analysis, and impact is limited to availability of the modem - no confidentiality or integrity loss, and no code execution. MediaTek has issued a fix under Patch ID MOLY01774038 / Issue ID MSV-8911.
RemediationAI
Apply the vendor fix identified by MediaTek Patch ID MOLY01774038 (Issue MSV-8911), which is distributed through the MediaTek October 2026 Product Security Bulletin (https://www.mediatek.com/product-security-bulletin/October-2026); because modem firmware is delivered inside OEM/carrier device images rather than as a standalone download, end users and fleet owners must obtain the corresponding firmware update from the device or module manufacturer rather than from MediaTek directly. Until that image is available, the most effective compensating control is to reduce exposure to rogue base stations: disable legacy 2G/3G RATs where the device supports it (side effect: loss of coverage in areas where only legacy radio access remains, and possible loss of roaming or emergency-call fallback), pin the device to the trusted home carrier and avoid automatic attachment to unknown PLMNs (side effect: degraded mobility and roaming convenience), and, where the platform supports it, enable rogue/fake base station detection or network-scanning protections (side effect: added battery drain and occasional false positives). Operators can additionally monitor for unexplained modem resets or baseband crashes as an indicator of attempted exploitation. None of these mitigations removes the underlying out-of-bounds read - they only shrink the window in which an attacker can host the rogue cell the victim would need to attach to.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-126 (Buffer Over-read) inside the cellular modem (baseband) firmware of a broad set of MediaTek chipsets. Modem firmware parses control-plane signaling delivered over the radio interface, and a missing permission check means certain fields or messages are dereferenced or indexed without first validating that the caller/cell is authorized to supply them, so a crafted transmission from an attacker-operated base station can push an out-of-bounds read. The essential precondition is that the UE has attached to or camped on a rogue cell - i.e., the attacker must run their own cellular radio infrastructure and be within RF range, which is reflected in the CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The underlying technology is baseband modem firmware shipped as part of the SoC platform, so it spans smartphone SoCs (Dimensity/Helio families) as well as connectivity, IoT, CPE and automotive parts - the EUVD list alone enumerates more than 80 part numbers including MT6761, MT6765, MT6771, MT6789, MT6833, MT6853, MT6877, MT6878, MT6885, MT6893, MT6983, MT6989, MT6990, MT8666, MT8667, MT8788, MT8791, MT8797, MT8883, MT8893, MT2716, MT2735 and MT2737. Note that the aggregated tags label this a 'Buffer Overflow / Denial Of Service', but the authoritative CWE and description describe an out-of-bounds read, not a write primitive; there is no evidence of memory corruption exploitable for code execution.
Know when Mt2735 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent radio vector (AV:A) with AC:H for the rogue-base-station precondition; no auth or UI; out-of-bounds read yields availability-only impact (A:H, C/I:N).
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8911.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek Modem OOB and Memory Corruption Flaws
View all 11More in Mt2735 Firmware
View allAn out-of-bounds read/write flaw in MediaTek's ccci (cross-core/modem control) component allows an authenticated local a
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Exploit-DB