CVE-2023-32874
Published: 02 January 2024
Summary
CVE-2023-32874 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Mediatek Lr13. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
In Modem IMS Stack, an out-of-bounds write vulnerability exists because of a missing bounds check, classified under CWE-787. The flaw affects MediaTek modem firmware and carries a CVSS 3.1 score of 9.8, indicating network-accessible impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can trigger the flaw over the network without user interaction or additional privileges, resulting in remote code execution on the device. The attack requires no local access or elevated execution rights beyond the initial network reachability.
MediaTek’s January 2024 security bulletin lists the issue as resolved under Patch ID MOLY01161803 and Issue ID MOLY01161803 (MSV-893), directing customers to apply the corresponding modem firmware update. The EPSS score remains flat at 0.0601 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-37095
Vulnerability details
In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:…
more
MOLY01161803; Issue ID: MOLY01161803 (MSV-893).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.