Is CVE-2026-20458 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20458 being exploited in the wild.

How severe is CVE-2026-20458?

Informational severity, published 1 July 2026.

Which products and versions are affected?

MediaTek Chipset MT2716, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6835, MT6858, MT6878, MT6879, MT6881, MT6886, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6986D, MT6988, MT6989, MT6990, MT6991, MT6993, MT8666, MT8667, MT8668, MT8673, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R.

Is there a fix for CVE-2026-20458?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20458 attacked?

It is attacked from the adjacent network, in device firmware.

Am I affected by CVE-2026-20458?

Check whether you run MediaTek Chipset at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20458: MediaTek Modem out-of-bounds write in multiple chipsets

CVE-2026-20458 · Severity: info · Published 2026-07-01

A vulnerability exists in the modem component of several MediaTek chipsets used in mobile devices. If a device connects to a malicious cellular base station controlled by an attacker, the attacker could gain unauthorized control or elevated privileges on the device. This attack occurs over the air and does not require any interaction from the user.

Technologies: MediaTek Chipset. Vendors: MediaTek.

Quick answers

Is CVE-2026-20458 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20458 being exploited in the wild.
How severe is CVE-2026-20458?: Informational severity, published 1 July 2026.
Which products and versions are affected?: MediaTek Chipset MT2716, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6835, MT6858, MT6878, MT6879, MT6881, MT6886, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6986D, MT6988, MT6989, MT6990, MT6991, MT6993, MT8666, MT8667, MT8668, MT8673, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R.
Is there a fix for CVE-2026-20458?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20458 attacked?: It is attacked from the adjacent network, in device firmware.
Am I affected by CVE-2026-20458?: Check whether you run MediaTek Chipset at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the MediaTek Modem firmware due to a missing bounds check. The vulnerability is triggered when a User Equipment (UE) connects to a rogue base station controlled by an attacker. This memory corruption can lead to remote escalation of privilege (EoP) within the modem subsystem. No additional execution privileges or user interaction are required for exploitation. MediaTek has released a patch under Patch ID MOLY01402160 to address this issue.

Affected products

MediaTek, Inc. MediaTek chipset MT2716, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6835, MT6858, MT6878, MT6879, MT6881, MT6886, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6986D, MT6988, MT6989, MT6990, MT6991, MT6993, MT8666, MT8667, MT8668, MT8673, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R

Timeline

2026-07-01: advisory: Published by MediaTek and NVD

References

https://corp.mediatek.com/product-security-bulletin/July-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.