This vulnerability is a classic heap buffer overflow (CWE-120) in the modem of MediaTek chipsets, which can be triggered remotely by connecting a UE to a malicious base station. The overflow can cause a system crash resulting in denial of service without requiring user interaction or elevated privileges. The issue affects numerous MediaTek chipset versions. Although a patch ID (MOLY01760138) and issue ID (MSV-6148) are referenced, no explicit patch or remediation level has been confirmed in the vendor advisory or CVE data. The vulnerability was published on May 4, 2026, and no CVSS score is available.

Successful exploitation results in a remote denial of service condition on affected devices by causing a system crash. There is no indication of privilege escalation or code execution beyond denial of service. Exploitation requires the UE to connect to a rogue base station controlled by an attacker. No user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The referenced patch ID suggests a fix may exist, but no official confirmation or update is provided. Until an official fix is available, avoid connecting devices to untrusted or rogue base stations where possible.