Cyber Resilience

CVE-2023-32874

Critical

Published: 02 January 2024

Published
02 January 2024
Modified
17 April 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0601 90.9th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-32874 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Mediatek Lr13. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

In Modem IMS Stack, an out-of-bounds write vulnerability exists because of a missing bounds check, classified under CWE-787. The flaw affects MediaTek modem firmware and carries a CVSS 3.1 score of 9.8, indicating network-accessible impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can trigger the flaw over the network without user interaction or additional privileges, resulting in remote code execution on the device. The attack requires no local access or elevated execution rights beyond the initial network reachability.

MediaTek’s January 2024 security bulletin lists the issue as resolved under Patch ID MOLY01161803 and Issue ID MOLY01161803 (MSV-893), directing customers to apply the corresponding modem firmware update. The EPSS score remains flat at 0.0601 with no observed rise after disclosure.

EU & UK References

Vulnerability details

In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:…

more

MOLY01161803; Issue ID: MOLY01161803 (MSV-893).

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

mediatek
lr13
all versions
mediatek
nr15
all versions
mediatek
nr16
all versions
mediatek
nr17
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

References