A missing bounds check in the MediaTek modem software allows an out‑of‑bounds write, which can be exploited by an attacker to gain privilege escalation on a user equipment device during a connection to a rogue base station. The flaw is identified as a classic CWE‑787 buffer over-read/write vulnerability. An attacker does not need additional execution privileges beyond establishing the deceptive base station connection, but user interaction is required to initiate the interaction.

The vulnerability affects a wide range of MediaTek chipset models listed in the CPE data, including MT2735, MT2737, MT6739, MT6761, MT6762, MT6765, MT6785, MT6855, MT6877, MT6880, MT6899, MT6980, MT8666, MT8768, and many others. Devices using these chipsets rely on the modem component where the flaw resides.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog. Exploitation requires the user to connect to a rogue base station controlled by the attacker; no additional privileges are needed beyond this. The attack vector is inferred to be a network-based interaction from a malicious base station, and the threat is mitigated by application of the vendor’s patch.