MediaTek Modem EUVD-2026-92200

Exploitation is gated by Adjacent-network radio access: the attacker must operate a rogue/false base station within cellular radio range and the target UE must attach to it before the malformed modem message can be delivered - this is the exact 'if a UE has connected to a rogue base station controlled by the attacker' condition in the advisory and is why AC is High. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the practical limiting factors are significant: physical/RF proximity, the operational effort of standing up a convincing rogue cell per target, and the fact that impact is confined to a modem crash (availability only). It is not remotely exploitable over the internet and does not affect default configurations reachable from a network path.

This is a medium-severity (CVSS 5.3) availability-only issue, and multiple signals agree it is NOT a top-tier priority despite the 'remote' framing. The CVSS vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H confirms impact is limited to availability (A:H) with no confidentiality or integrity effect, and critically the attack vector is Adjacent (AV:A) with High attack complexity (AC:H) - not truly 'network' reachable from the internet. The description reconciles this: exploitation requires the victim UE to first connect to a rogue base station the attacker controls, which is precisely why AC is High and AV is Adjacent rather than Network. No EPSS score was supplied, so exploitation probability cannot be quantified; there is no CISA KEV listing and no public POC referenced, so this is not actively exploited. SSVC-style reasoning: exploitation=none observed, automatable=no (requires physical radio proximity and a rogue cell per target), technical impact=partial (DoS/crash only). The practical risk is a localized, targeted radio-proximity denial of service (baseband/modem crash), not a scalable remote compromise. No conflicting signals of note - the CVSS vector and description are consistent; the main caveat is the absence of EPSS data to confirm the low real-world exploitation likelihood implied by the other metrics.

An attacker stands up a rogue cellular base station (false cell) in physical radio range of a target device and induces the victim UE to attach to it. The attacker then sends crafted signaling/modem messages that hit a missing bounds check (CWE-129, improper array index validation), crashing the baseband modem and denying cellular service. No public exploit code has been identified, and the attack requires proximity plus a controlled rogue cell, making it targeted rather than mass-scalable.