EUVD-2026-92185
GHSA-h6c4-mvxr-gf42
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeploy rogue base station in radio range
-
DeliveryInduce victim UE to attach
-
ExploitSend crafted signaling to modem
-
ExecutionTrigger out-of-bounds read in baseband
-
ImpactModem crash and loss of cellular service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
|
| Exploitation Conditions | Exploitation requires the victim UE to have attached to a rogue (attacker-controlled) base station operating within cellular radio range - this is the explicit precondition in the description and the source of AV:A and AC:H. The attacker must therefore run rogue radio infrastructure and successfully induce attachment (e.g., via a stronger signal / downgrade), which is a significant limiting factor that confines this to targeted, physically proximate scenarios rather than remote mass exploitation. No authentication or user interaction is needed once attached (PR:N, UI:N per the provided vector). Impact is limited to denial of service (A:H only); there is no confidentiality or integrity effect, and no additional execution privileges are gained. |
| Impact | This is a moderate-severity (CVSS 5.3) availability-only flaw whose real-world priority is LOW despite affecting a very large chipset footprint. All exploitation signals point the same direction and reinforce each other: the CVSS vector is AV:A (adjacent/radio proximity, not Internet-routable) with AC:H (high attack complexity), and the only impact is A:H (denial of service) with C:N/I:N - no code execution, data disclosure, or integrity loss. The SSVC decision framework agrees: Exploitation=none, Automatable=no, Technical Impact=partial, which maps to a 'Track' rather than 'Act' posture. EPSS score was NOT provided in the input, so exploitation probability cannot be quantified - this is a data gap. There is no CISA KEV listing and no POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' No signals conflict here. The dominant limiting factor is the AC:H prerequisite: the attacker must operate a rogue base station in radio range AND the victim UE must attach to it, which is non-trivial, targeted, and physically proximate - not a mass-exploitable remote condition. Net: a genuine but narrow radio-adjacent DoS that warrants routine patching via the vendor bulletin, not emergency response. |
| Exploit ScenarioDerived | An attacker stands up a rogue cellular base station within radio range of a target area and lures a nearby MediaTek-modem device into attaching to it. Once the UE connects, the attacker sends malformed signaling that triggers an out-of-bounds read in the modem firmware, crashing the baseband and denying cellular service to the victim. No public exploit code is referenced, and the attack requires physical proximity plus a successful rogue-cell attachment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Denial of service against the cellular modem firmware shipped in a very broad range of MediaTek chipsets (MT6739 through MT6993/MT8893 families) arises from an out-of-bounds read caused by a missing permission check. The precondition is that the victim user equipment has already attached to a rogue base station under the attacker's control, meaning the adversary must operate radio infrastructure within range and successfully induce attachment (downgrade or stronger-signal lure) - hence the AV:A/AC:H scoring and the LOW real-world priority despite the enormous chipset footprint. Once attached, exploiting the flaw requires no authentication (PR:N) and no user interaction (UI:N), but the outcome is availability-only (A:H, with no confidentiality or integrity impact); there is confirmed no active exploitation (CISA KEV absent), no public exploit code identified at time of analysis, and no EPSS signal was provided in the source data.
RemediationAI
Vendor-released patch: MediaTek patch ID MOLY01774038 (tracked internally as issue MSV-8914), published through the MediaTek Product Security Bulletin for October 2026 at https://www.mediatek.com/product-security-bulletin/October-2026; because this is baseband firmware, there is no user-installable fix - the corrected modem image must be integrated by the device OEM into a firmware/OTA update, so affected organizations should track their handset, CPE, automotive or IoT supplier for the corresponding build and treat chipset-level patching as complete only once the OEM image ships. Where patching cannot be obtained, the mitigations are architectural rather than procedural: given that the trigger is attachment to an attacker-controlled base station, generic endpoint controls cannot prevent reaching the vulnerable code path, so operators of high-value mobile endpoints should consider disabling legacy radio capabilities that make downgrade-to-rogue-cell attachment easier (2G/EDGE fallback, and where policy allows, unencrypted or unauthenticated network selection), accepting the trade-off of reduced coverage and possible loss of roaming or emergency-service access in some regions; alternatively, restrict such devices to trusted private/enterprise radio deployments or MVNO networks with controlled base-station trust, flagging potential disruption in isolated or rural coverage areas. Note that no public exploit code or proof-of-concept was identified at time of analysis and CISA SSVC records exploitation as none and automatable as no, so emergency exception processes should not be triggered by this CVE alone.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the modem/baseband component of MediaTek SoCs rather than in application software, and is classified as CWE-126 (Buffer Over-read), the same root-cause class as many baseband parser bugs: a length, index, or bounds constraint is not validated before the modem reads beyond the end of a buffer. The description attributes the over-read specifically to a missing permission check, meaning a modem message or state transition that should be gated behind an authorization/permission verification is processed without that gate, allowing malformed or unexpected input to reach parsing code that indexes past the buffer boundary. The affected surface is the radio interface, which is why the assessed vector is CVSS:3.1/AV:A (adjacent/radio-adjacent) with AC:H (attack complexity high) - the attacker must stand up and operate a rogue base station and get the target UE to attach to it before any of this is reachable. PR:N/UI:N confirm that, once attachment is achieved, no credentials or victim action are needed, and the scope is unchanged (S:U) with impact confined to availability (C:N/I:N/A:H), consistent with an anomalous read that destabilizes modem firmware and drops connectivity rather than one that leaks memory to the attacker.
Know when Mt2735 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:A and AC:H because exploitation needs a radio-proximate rogue base station the victim must attach to; A:H only, with C:N/I:N as impact is DoS via out-of-bounds read.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8914.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek Modem OOB and Memory Corruption Flaws
View all 11More in Mt2735 Firmware
View allAn out-of-bounds read/write flaw in MediaTek's ccci (cross-core/modem control) component allows an authenticated local a
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Exploit-DB