The flaw resides in the modem assembly of MediaTek chipsets, where a missing bounds check can cause an out‑of‑bounds write. An attacker who can orchestrate a rogue base station may trick an intended user equipment into connecting, leading the device to gain privileges beyond its normal level. The issue does not require user interaction or additional execution privileges beyond the connection with the malicious base station.

MediaTek, Inc. chipsets used in mobile modem products are impacted, specifically within the modem firmware. No specific version information is provided in the advisory, so all firmware revisions that include the vulnerable code segment are considered at risk.

The CVSS score is not published, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is remote and available to anyone capable of emitting a rogue base station signal, meaning exploitation is likely to be straightforward once the malicious base station is in place. The lack of user interaction lowers the barrier further, and there are no additional prerequisites beyond controlling the base station.