EUVD-2026-92189
GHSA-vv5q-53j2-fq73
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeploy rogue base station in radio range
-
DeliveryInduce victim UE to camp on rogue cell
-
ExploitSend malformed signaling message
-
ExecutionTrigger out-of-bounds read in modem parser
-
ImpactCrash modem / deny cellular service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target UE (handset using an affected MediaTek modem) first connect to a rogue base station controlled by the attacker - i.e. the attacker must operate a malicious cellular cell within radio range and get the victim device to camp on it (reflected as AV:A, adjacent, and AC:H). No authentication and no user interaction are required once that association occurs (PR:N/UI:N). Impact is limited to availability (A:H, modem denial of service) with no confidentiality or integrity effect (C:N/I:N). Realistic limiting factors for defenders: the need for physical radio proximity and a functioning rogue base station, the absence of any confirmed in-the-wild exploitation (SSVC Exploitation=none), non-automatable exploitation (SSVC Automatable=no), and applicability only to the enumerated MediaTek chipset models running vulnerable modem firmware. |
| Impact | This is a genuine-but-bounded issue, not a top-priority emergency. The input CVSS of 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly captures the profile: adjacent attack vector (not true network/Internet reach), high attack complexity, no privileges or user interaction, and availability-only impact (C:N/I:N - no confidentiality or integrity loss). The limiting factor is that the victim UE must first associate with an attacker-controlled rogue base station, which is why AV:A and AC:H are appropriate rather than AV:N. All corroborating exploitation signals point the same direction and reinforce low urgency: CISA SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. The signals are internally consistent - there is no CVSS-versus-reality conflict here - though note a tagging discrepancy: the input carries 'Buffer Overflow' and 'Information Disclosure' tags, yet the CWE is CWE-125 (out-of-bounds READ, not an overflow/write) and the CVSS sets C:N, so no confidentiality/information-disclosure impact is actually claimed by the vendor scoring. Treat this as a localized radio-proximity denial-of-service risk against MediaTek modem firmware, prioritized via normal mobile OTA/vendor patch cycles rather than emergency response. |
| Exploit ScenarioDerived | An attacker stands up a rogue cellular base station (false base station / IMSI-catcher style cell) in physical radio proximity to victims and induces nearby MediaTek-modem handsets to camp on it. The attacker then transmits a malformed signaling/protocol message that the modem parses with an incorrect bounds check, triggering an out-of-bounds read that crashes the modem and denies cellular service. No public exploit code or PoC was identified in the provided intelligence, and SSVC marks exploitation as none. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Modem denial of service in MediaTek baseband firmware allows an attacker operating a rogue base station within radio range to crash or reset a victim handset's modem through an out-of-bounds read (CWE-125) caused by an incorrect bounds check on attacker-influenced over-the-air data. The attacker must first get the target UE to camp on the malicious cell (CVSS 3.1 AV:A/AC:H), after which no privileges and no user interaction are required, and the only impact is loss of availability of the modem (A:H, C:N/I:N), yielding a 5.3 base score. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and applicability is limited to devices built on the enumerated MediaTek chipset models with vulnerable modem firmware, so this is a genuine but bounded, proximity-dependent availability risk rather than a mass-exploitation emergency.
RemediationAI
Vendor-released patch: apply the modem/baseband fix identified by MediaTek patch ID MOLY01797547 (issue MSV-9155), distributed through the MediaTek Product Security Bulletin for October 2026 (https://www.mediatek.com/product-security-bulletin/October-2026). Since this is chipset-level firmware, the fix reaches end users only via OEM/device-vendor or carrier firmware updates, so fleet owners should track their handset, module and CPE vendors' advisories and require confirmation that MOLY01797547 is included in the build; for devices that cannot be updated, treat them as unpatched for this issue. Because exploitation requires a rogue base station in radio range, the most effective compensating controls are on the network side rather than the device: enforce subscriber/network mutual authentication (5G AKA, or the strongest authentication the carrier supports), enable and monitor the carrier's or operator's rogue-base-station/IMSI-catcher detection so anomalous cells are flagged or blocked, and - where the device management profile allows it and coverage requirements permit - restrict automatic attachment to untrusted or non-authenticated cells. The trade-offs are real: disabling legacy radio modes or tightening cell-selection policies can reduce coverage, roaming or emergency-service reachability, and network-side detection does not help a device that is already camped on the attacker's cell, so firmware remediation remains the only complete fix. Given SSVC Exploitation=none, Automatable=no and the absence of public exploit code or KEV listing, remediation can follow a normal patch cycle, prioritized for high-value or physically exposed users (executives, field personnel, high-security sites) where rogue-cell activity is plausible.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds read (CWE-125) in the modem/baseband component of MediaTek chipsets: a length or offset derived from data received over the radio interface is validated incorrectly, letting the modem firmware read past the end of an intended buffer. Because the input path is the cellular air interface rather than an IP socket, the practical attack surface is the base station side of the link - the attacker must run a rogue cell (a fake eNodeB/gNodeB-style setup) and induce the UE to attach to it, which is why the assessed vector is adjacent (AV:A) with high attack complexity (AC:H): the attacker needs both physical radio proximity and the victim device to select the malicious cell. No credentials (PR:N) and no user action (UI:N) are needed once that association is established. The scanning-context tags (Buffer Overflow, Denial Of Service, Information Disclosure) reflect the memory-safety class of the bug, but the independently assessed impact is availability-only - the out-of-bounds read manifests as a modem crash/reset rather than a demonstrated confidentiality or integrity compromise, hence C:N/I:N/A:H. Fixes are delivered as baseband/modem firmware patches (patch ID MOLY01797547, issue MSV-9155) that must be propagated by MediaTek's chipset customers into device firmware.
Know when Mt2735 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent radio vector (AV:A) with AC:H because the victim must camp on an attacker's rogue base station; no auth or interaction (PR:N/UI:N); out-of-bounds read yields availability-only impact (A:H, C:N/I:N).
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01797547; Issue ID: MSV-9155.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in MediaTek Modem OOB and Memory Corruption Flaws
View all 11More in Mt2735 Firmware
View allAn out-of-bounds read/write flaw in MediaTek's ccci (cross-core/modem control) component allows an authenticated local a
In Modem, there is a possible system crash due to improper input validation. Rated medium severity (CVSS 6.5), this vuln
Exploit-DB