Executive brief
A vulnerability in the modem component of various MediaTek chipsets could allow a nearby attacker to crash a mobile device. By using a rogue base station to mimic a legitimate cellular tower, an attacker can trigger a system failure on any device that connects to it. This results in a total loss of cellular connectivity and device stability for the user until the system is recovered.
Technical details
An improper input validation vulnerability exists in the MediaTek Modem firmware, specifically identified as a NULL pointer dereference (CWE-476). The flaw is triggered when a User Equipment (UE) device connects to a rogue base station controlled by an attacker. The attacker can send malformed inputs that the modem fails to validate, resulting in a system crash and subsequent denial of service. No special execution privileges or user interaction are required for exploitation. MediaTek has released a patch under ID MOLY01826924 to address this issue.
Affected products
- MediaTek, Inc. MediaTek chipset MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6980, MT6983, MT6985, MT6989, MT6990, MT8666, MT8667, MT8673, MT8675, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8781
Timeline
- 2026-07-01: advisory: MediaTek published the July 2026 Product Security Bulletin.
- 2026-07-01: disclosed: CVE record published to the NVD.