The vulnerability is an out‑of‑bounds read in the modem firmware caused by a missing permission check. Because no additional privileges are required, an attacker controlling a rogue base station can trigger the flaw simply by having a user equipment connect to that station; the result is a potential denial of service that would prevent the device from communicating with legitimate networks. This weakness is classified as CWE‑126.

The flaw affects MediaTek chipsets that use Mediatek Modem firmware. The vendor has provided an official patch (MOLY01774038) for the issue ID MSV‑8911, though no publicly listed affected version numbers are available.

With a CVSS score of 5.3 and the EPSS unavailable, the vulnerability is moderately severe. It is not listed in the CISA KEV catalog, suggesting limited known exploitation. Nonetheless, the absence of user interaction and the ease with which a rogue base station can present itself to a device make the risk of denial of service significant for operators and consumers.