There is a missing bounds check in the modem component of MediaTek chipsets that allows an out-of-bounds write. An attacker who can make a user equipment (UE) connect to a rogue base station can exploit the flaw without any user interaction, causing remote escalation of privilege on the device.

The vulnerability affects MediaTek chipsets used in cellular modems. No specific product versions are listed; all affected devices with this modem implementation should be considered at risk.

The vulnerability is a high severity flaw that provides remote privilege escalation. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the lack of user interaction and the ability to target any UE connected to a rogue base station suggest a realistic exploitation scenario. The attack vector is network-based via a malicious base station, and no additional privileges are required on the victim side.