An out‑of‑bounds write in MediaTek modem firmware, caused by a missing bounds check on the reception of a connection handshake, can enable an attacker connected to a rogue base station to overwrite memory and increase the device’s privileges. The flaw is a CWE‑787 defect and does not require the attacker to have any existing execution rights; user interaction is required.

This vulnerability impacts MediaTek chipsets ranging from MT2735 through MT8893, including all firmware releases listed in the CPE data. Any device that uses these chipsets for modem operations is potentially affected.

The CVSS score of 8 classifies it as high severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation in the near term. The flaw is not listed in the CISA KEV catalog. Exploitation requires proximity to a rogue base station and the device to connect to it; once the connection is established, no further privileges are required, so the real‑world risk depends on the attacker’s ability to deploy malicious radio equipment near the target populace.