EUVD-2026-92183
GHSA-qcwv-wm5j-jgj5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeploy rogue base station near target
-
DeliveryInduce victim UE to attach
-
ExploitSend malformed radio-layer message
-
ExecutionTrigger out-of-bounds read in modem
-
ImpactBaseband crash denies cellular service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
|
| Exploitation Conditions | Exploitation requires the attacker to operate a rogue/malicious base station and to get the victim UE to connect to it over the cellular radio interface - this adjacent-network precondition (AV:A) plus the setup effort is precisely what drives the high attack complexity (AC:H). No authentication (PR:N) and no user interaction (UI:N) are needed once the device has attached. The limiting factors are substantial: the attacker needs specialized radio hardware, physical proximity to the target, and successful victim attachment to the rogue cell; the impact is confined to denial of service (baseband crash), with no code execution, data disclosure, or integrity compromise. Affected scope is MediaTek modem firmware across the listed chipsets (e.g., MT6765, MT6883, MT6991, MT8798). |
| Impact | This is a genuine-but-moderate issue, correctly rated medium (CVSS 5.3). The CVSS vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H is internally consistent with the description: exploitation occurs over the radio interface (AV:A - adjacent, not true network/Internet reach), requires no authentication (PR:N) and no user interaction (UI:N), but carries high attack complexity (AC:H) because the attacker must stand up a rogue base station AND induce the victim UE to attach to it. Impact is availability-only (A:H, a denial of service) with no confidentiality or integrity loss (C:N/I:N) - consistent with CWE-126 (out-of-bounds/buffer over-read). The SSVC framework reinforces a low-urgency posture: Exploitation=none (no observed activity), Automatable=no (each attack requires physical radio proximity and victim attachment, so it cannot be scripted at scale), Technical Impact=partial. There is no KEV listing and no public POC, and no EPSS score was supplied - absence of EPSS is a data gap, not evidence either way. All signals align: this is a real but low-priority defect - a targeted, proximity-bound DoS rather than a wormable or remotely weaponizable flaw. Priority should be routine patch-cycle remediation, not emergency response. |
| Exploit ScenarioDerived | An attacker deploys a rogue/IMSI-catcher-style base station near a target and tricks a nearby MediaTek-modem device into attaching to it. The attacker then sends a crafted malformed radio-layer message that triggers an out-of-bounds read in the modem firmware, crashing the baseband and denying cellular service to the victim. No public exploit code is known, and the attack requires both specialized radio equipment and physical proximity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT6785, MT6833, MT6883, MT6985, MT6991 and MT8798 - where a missing bounds check during cellular message parsing produces an out-of-bounds read (CWE-126) that can crash the baseband. An attacker who operates a rogue base station and gets a victim UE to attach can trigger the fault with no authentication (PR:N) and no user interaction (UI:N), though the adjacent-network position and specialized radio hardware required drive the high attack complexity (AC:H) and the CVSS 3.1 score of 5.3, with impact limited to availability. Neither our independent assessment nor CISA's SSVC framework records known exploitation (Exploitation: none, Automatable: no), so no public exploit is identified at time of analysis.
RemediationAI
Vendor-released patch: Patch ID MOLY01774038 (MediaTek Product Security Bulletin, October 2026 - https://www.mediatek.com/product-security-bulletin/October-2026); OEMs and module vendors must incorporate this baseband firmware fix into device updates, so the practical action for enterprises is to track firmware updates from their handset, tablet, IoT and CPE suppliers and treat the modem stack as part of the patchable attack surface. Until firmware is applied, user-level mitigation is limited because the fault is reached over the radio interface; the most effective compensating control is to avoid attaching to untrusted or suspicious cells, and where deployment policy permits, disable or deprioritize legacy RATs (for example 2G/GSM) that are easiest for a rogue base station to impersonate - with the trade-off that coverage, roaming and some IoT connectivity may be lost. Mobile network operators can reduce exposure by deploying false-base-station and RRC/NAS anomaly detection, accepting the operational cost and residual false-positive rate of that monitoring. Physically isolating radio hardware (modem sandboxing, airplane mode) prevents the attack entirely but removes cellular service, and is only practical for high-assurance or forensic use cases; there is no configuration setting that hardens the vulnerable message parser itself.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in MediaTek modem firmware that parses over-the-air cellular signaling (the baseband stack handling the radio interface between UE and network) and is classified as CWE-126, buffer over-read, caused by a missing bounds check on a length or index field before memory is read. Rather than corrupting memory or enabling code execution, the unchecked read can pull data past the end of an allocated buffer, which in a baseband processor typically manifests as an assertion, watchdog reset, or crash of the modem subsystem. The CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the exploit path is adjacent-network (the rogue base station the UE associates with), unauthenticated and interaction-free once attachment occurs, but with high complexity and no confidentiality or integrity impact. Affected hardware spans MediaTek's smartphone, tablet, IoT and CPE silicon families listed in the EUVD record; the advisory reference is MediaTek's October 2026 Product Security Bulletin.
Know when Mt2735 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:A and AC:H because exploitation needs a rogue base station the victim must attach to; PR:N/UI:N per description; impact is DoS only, so C:N/I:N/A:H.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8912.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek Modem OOB and Memory Corruption Flaws
View all 11More in Mt2735 Firmware
View allAn out-of-bounds read/write flaw in MediaTek's ccci (cross-core/modem control) component allows an authenticated local a
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Exploit-DB