MediaTek Fixes 31 Security Flaws Affecting Modem, Video and AI Components
MediaTek's October bulletin patches 31 chipset flaws, including two critical modem out-of-bounds writes, with no known exploitation.
64
Vulnerability4 · 1 read
CVE-2026-20520
Out-of-bounds write in MediaTek modem allows remote privilege escalation
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
MediaTek’s modem has an out-of-bounds write (CWE-787) caused by a missing bounds check. If a phone or other user equipment connects to a rogue base station controlled by an attacker, the flaw can be triggered remotely with no extra privileges and no user interaction, and can escalate privilege on the device. Affected chipsets and firmware versions are not listed in the public data; the fix is identified only as patch MOLY01778988 (issue MSV-8897). MediaTek disclosed it among a set of modem, video, and AI fixes. No public proof-of-concept is known, CVSS is not yet scored, and it is not on the CISA Known Exploited Vulnerabilities list.
What to do: Install device firmware that includes MediaTek patch MOLY01778988 as soon as the handset maker or carrier ships it, and confirm coverage of issue MSV-8897 in the vendor bulletin. Until patched, the practical exposure is a connection to an attacker-controlled base station, so apply OEM updates promptly and do not rely on a specific version number that this advisory does not publish. No public exploit is known and the issue is not in CISA KEV.
| Product | Affected |
|---|---|
| MediaTek Modem | — |
Estimated exposure
massOn the order of 100 million or more MediaTek-modem devices; exact vulnerable chipset set unpublished — MediaTek modems ship in a very large share of Android smartphones worldwide, so even one widely deployed modem generation is well above one million devices; the advisory does not name chipsets, so this is an installed-base order of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778988; Issue ID: MSV-8897.
- Vendors
- mediatek
- Products
- mt2716 firmware, mt2735 firmware, mt2737 firmware, mt6813 firmware, mt6815 firmware, mt6833 firmware, mt6835 firmware, mt6853 firmware, mt6855 firmware, mt6858 firmware, mt6873 firmware, mt6875 firmware
- Weakness
- CWE-787
- Vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H