CVE-2023-32886

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00730807; Issue ID: MOLY00730807.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
MediaTek, Inc.MT2735, MT6813, MT6833, MT6833P, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6877T, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT68Modem NR15, NR16, and NR17

References

Timeline

Published
Jan 2, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-328877.5In Modem IMS Stack, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no addiCVE-2023-328887.5In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service witCVE-2023-328897.5In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service witCVE-2023-32896.5A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This rCVE-2023-328907.5In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additioCVE-2023-328916.7In bluetooth service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of priviCVE-2023-32905.0A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results CVE-2023-32913.3Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-32926.1The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attriCVE-2023-32934.8Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.CVE-2023-32946.1Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.CVE-2023-32958.8The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing