In the MediaTek modem firmware a missing bounds check allows an out‑of‑bounds write. This flaw can be triggered when a user equipment (UE) connects to a rogue base station under an attacker’s control, granting the attacker privilege escalation without any user interaction or additional execution privileges.

The affected product is the MediaTek chipset’s modem component. No specific firmware or hardware revision numbers are listed, but the issue applies to all MediaTek chipsets that include the vulnerable modem code referenced by the Patch ID MOLY01778993.

The vulnerability can be exploited by any attacker able to set up a rogue base station that the UE will connect to. The exploit requires no user action once the UE is in range, making it highly actionable from the attacker’s perspective. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the remote privilege escalation risk remains high due to the lack of bounds enforcement in the modem firmware. The CVSS score of 7.5 signifies a high severity rating.