A missing bounds check in the modem firmware results in an out‑of‑bounds write, allowing an attacker to corrupt memory. When a user equipment (UE) connects to a rogue base station under attack, the flaw can be abused to gain elevated privileges on the device. The exploit requires no user interaction and does not depend on additional execution contexts. The root cause is identified as a classic bounds‑check omission (CWE‑787).

The flaw affects MediaTek chipsets shipped in consumer devices that run the native modem firmware. No specific hardware revisions or software versions are enumerated in the advisory; however, all MediaTek chipsets that use the affected modem component are considered vulnerable.

Although the exact CVSS score is not disclosed, the capability to achieve privilege escalation without user involvement represents a severe risk. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, yet the potential impact and ease of exploitation warrant close attention. An adversary would need only to engineer a rogue base station that the UE would accept, indicating that the attack vector is feasible in environments where base station authentication is weak or absent.