MediaTek Fixes 31 Security Flaws Affecting Modem, Video and AI Components
MediaTek's October bulletin patches 31 chipset flaws, including two critical modem out-of-bounds writes, with no known exploitation.
64
Vulnerability1 · 1 read
CVE-2026-20527
Missing bounds check DoS in MediaTek modem
- CVSS 3.1
- 5.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-20527 is a missing bounds check (CWE-129, improper array-index validation) in MediaTek modem software that can crash the system. A remote attacker who controls a rogue base station can trigger it when user equipment attaches to that station, with no extra privileges and no user interaction. The stated impact is remote denial of service, not code execution. MediaTek modem firmware is affected; the advisory gives patch IDs MOLY01864925 and MOLY01210562 (MSV-8303) but does not list chipsets or version ranges, and the issue is one of a reported set of MediaTek modem, video, and AI fixes. It is not on the CISA KEV list, has no CVSS score yet, and no public proof-of-concept is known.
What to do: Install the OEM or carrier firmware update that includes MediaTek modem patches MOLY01864925 and MOLY01210562 (issue MSV-8303). Until devices are patched, treat unexpected cell-site attachments as a risk and prefer known networks; there is no user action that fully blocks a rogue base station. Confirm with the device maker which chipsets and builds actually contain the fix, because this advisory does not list product versions.
| Product | Affected |
|---|---|
| MediaTek Modem (cellular modem firmware) | — |
Estimated exposure
massPotentially hundreds of millions of MediaTek-modem devices if the flaw is in widely shipped modem firmware; exact count unknown — MediaTek supplies cellular modems and SoCs for a large share of Android phones and other cellular devices, commonly on the order of hundreds of millions of units shipped per year, but this CVE does not name chipsets or builds, so the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01864925 / MOLY01210562; Issue ID: MSV-8303.
- Vendors
- mediatek
- Products
- mt2716 firmware, mt2735 firmware, mt2737 firmware, mt6813 firmware, mt6815 firmware, mt6833 firmware, mt6835 firmware, mt6853 firmware, mt6855 firmware, mt6858 firmware, mt6873 firmware, mt6875 firmware
- Weakness
- CWE-129
- Vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H