MediaTek Fixes 31 Security Flaws Affecting Modem, Video and AI Components
MediaTek's October bulletin patches 31 chipset flaws, including two critical modem out-of-bounds writes, with no known exploitation.
64
CVE-2026-20519
Out-of-bounds write in MediaTek modem via rogue base station
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-20519 is an out-of-bounds write (CWE-787) in the MediaTek modem caused by a missing bounds check. A remote attacker who operates a rogue base station can trigger the flaw when a user equipment device connects to that station, with no user interaction and no additional privileges required. Successful exploitation can lead to remote escalation of privilege on the device. The advisory identifies patch MOLY01778993 and issue MSV-8898 but does not list chipsets or firmware version ranges. It is not in CISA KEV, has no known public proof of concept, and CVSS has not yet been scored.
What to do: Install the OEM or carrier firmware update that includes MediaTek modem patch MOLY01778993 (issue MSV-8898) as soon as it is offered for your device. Until then, treat cellular connectivity as untrusted: prefer known networks, and have mobile-device management confirm that handsets with MediaTek modems are on a patched build. There is no user-side configuration that replaces the vendor patch.
| Product | Affected |
|---|---|
| MediaTek Modem | — |
Estimated exposure
massPotentially hundreds of millions of handsets (order of magnitude; exact vulnerable subset unknown) — MediaTek supplies cellular modems and SoCs used in a large share of Android smartphones worldwide, so the plausible installed base is well above one million devices; the CVE does not name chipsets or firmware versions, so this is an…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778993; Issue ID: MSV-8898.
- Vendors
- mediatek
- Products
- mt6833 firmware, mt6835 firmware, mt6853 firmware, mt6855 firmware, mt6858 firmware, mt6873 firmware, mt6875 firmware, mt6877 firmware, mt6878 firmware, mt6879 firmware, mt6880 firmware, mt6881 firmware
- Weakness
- CWE-787
- Vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H