The vulnerability is an out-of-bounds write caused by an incorrect bounds check in the MediaTek modem firmware. An attacker can trigger this flaw by supplying crafted data that writes beyond a buffer’s limits, which can crash the modem subsystem and result in a denial of service for local users. The flaw does not grant the attacker any additional execution privileges. The affected weakness is identified as CWE-787.

The defect resides in the MediaTek chipset’s modem component. No specific version information is provided in the advisory, so any device running the current modem firmware from MediaTek is potentially impacted.

The exploit does not require user interaction, meaning that an attacker can trigger it without any user involvement. The flaw involves an incorrect bounds check that allows an overrun, overwriting memory, which can crash the modem subsystem and cause a denial of service for local users or services. Since elevated privileges are not required, the attack can succeed from a local context or potentially from any remote interface that feeds malformed data to the modem. The absence of a CVSS or EPSS score limits quantitative assessment, but the denial of service can degrade device availability. The vulnerability is not listed in CISA KEV, indicating no widespread exploitation is recorded.