Description

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00755024; Issue ID: MSV-7865.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T02:17:19.143Z",
  "pubdate": "2026-09-07T02:17:19.143Z",
  "executiveSummary": "A critical vulnerability identified as MSV-7865 exists within the Modem component, characterized by an inadequate bounds check during data processing.\nThis flaw allows a remote attacker to induce a system crash, effectively resulting in a denial-of-service (DoS) condition.\nThe vulnerability is exploitable when a User Equipment (UE) device establishes a connection with a malicious or rogue base station, which acts as the vector for delivering crafted payloads.\nExploitation does not require additional execution privileges or user interaction, significantly lowering the barrier for attack success.\nThe primary risk involves the disruption of critical modem services, potentially leading to total loss of connectivity for the affected device.\nThe issue is tracked under Patch ID: MOLY00755024 and represents a severe concern for mobile infrastructure integrity and device availability.",
  "technicalDetails": "The vulnerability originates from a failure to perform rigorous bounds checking on input data processed by the Modem firmware. In the context of mobile radio resource management, the modem expects specific data structures and packet sizes from the base station (eNodeB or gNodeB). When the modem receives a malformed packet from a rogue base station that exceeds the pre-allocated buffer size or violates expected length constraints, the system experiences a memory corruption event.\nSpecifically, the root cause is a lack of validation regarding incoming frame sizes before memory copy operations or buffer indexing occur. When a rogue base station transmits a payload specifically crafted to exceed the expected bounds of the internal memory structures, the application attempts to access or write into illegal memory regions. This triggers an unhandled exception or a segmentation fault within the modem's real-time operating system (RTOS) or baseband processing environment, leading to a system-wide crash.\nThe exploitation flow is as follows: 1) An attacker establishes a rogue base station within proximity of the target UE. 2) The target device performs a cell selection or handover process to connect to the malicious station. 3) Upon successful synchronization, the attacker transmits a series of intentionally oversized or malformed protocol data units (PDUs). 4) The modem’s protocol stack processes these units without performing the necessary boundary validation. 5) The resulting buffer overflow or out-of-bounds access corrupts critical kernel memory or internal control variables, inducing a crash of the baseband processor.\nSince the attack occurs at the radio interface level, it is categorized as a remote exploit. It requires no authentication or user interaction from the device owner, as the modem processes these signals automatically as part of its standard communication protocol duties. The post-exploitation impact is limited to a system-wide denial-of-service, necessitating a device reboot to restore functionality. The vulnerability highlights a failure in input sanitization within the lower-layer protocol processing, which is exacerbated by the modem's high-privilege execution state."
}