Out-of-bounds write in MediaTek Modem

Successful exploitation could result in remote escalation of privilege in the modem context. Because the issue is an out-of-bounds write, impact may include corruption of adjacent memory and compromise of confidentiality, integrity, and availability within the affected component. The provided content states that no additional execution privileges are required and that exploitation can occur when the target UE connects to an attacker-controlled rogue base station.

Until patched firmware is deployed, reduce exposure to rogue cellular infrastructure where operationally possible. Practical mitigations are limited because exploitation occurs at the modem/baseband layer when the UE connects to an attacker-controlled base station. Prefer trusted carrier environments and timely installation of OEM security updates.

Apply the vendor patch associated with Patch ID MOLY01088681 as referenced by MediaTek in its April 2026 product security bulletin. Deploy the corresponding OEM/device firmware update from the handset vendor, as Samsung indicates this CVE was already included in previous updates for affected Samsung devices.