The vulnerability is a missing bounds check in MediaTek modem firmware that permits an out‑of‑bounds read. If executed by an attacker through a rogue base station, the read can trigger a denial of service in the modem. No user interaction or elevated privileges are needed, making it a straightforward network‑side attack that compromises device availability.

MediaTek chipsets from MediaTek, Inc. that include the modem firmware are affected. The issue is documented as Patch ID MOLY01876664 and Issue ID MSV‑9834, but specific firmware versions were not disclosed in the advisory. Devices that use these chipsets and rely on cellular connectivity are at risk.

The exploit can be launched by any entity that can set up a rogue base station. Remote exploitation requires no user action and no special privileges, raising the practical risk. EPSS metrics are not provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation yet. However, the absence of user interaction and the ability to disrupt connectivity make the threat significant for affected deployments.