CVE-2026-20540: Medium severity MediaTek Modem vulnerability
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8912.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch MOLY01774038
Event History
Frequently Asked Questions
Which devices or users are exposed to exploitation?
A user equipment (UE) is exposed when it connects to a rogue base station controlled by an attacker. The issue affects the MediaTek Modem component identified in the advisory data.
What does an attacker need to exploit this issue?
The attacker needs to operate or control a rogue base station and have a UE connect to it. No additional execution privileges or user interaction are required.
What is the likely impact of successful exploitation?
Successful exploitation can cause a remote denial of service through an out-of-bounds read in the modem.
What identifier should be used to track the vendor fix?
Use MediaTek Patch ID MOLY01774038 and Issue ID MSV-8912 when tracking remediation.