CVE-2026-20500: MediaTek Modem system crash due to improper input validation

CVE-2026-20500 · Severity: medium · CVSS 5.5 · Published 2026-09-07

A vulnerability in MediaTek's modem firmware can cause a system crash when processing specially crafted input. The modem is a critical radio component found in smartphones and IoT devices; crashing it causes temporary loss of connectivity and service availability. An attacker with local user privileges and ability to interact with the device can trigger a denial of service.

Technologies: MediaTek Mt2716, MediaTek MT2716 Modem, MediaTek Mt6835, MediaTek MT6835 Modem, MediaTek Mt6835 Firmware, MediaTek MT6858, MediaTek MT6858 Modem, MediaTek Mt6858 Firmware, MediaTek Mt6878, MediaTek MT6878 Modem, MediaTek Mt6878 Firmware, MediaTek Mt6881, MediaTek MT6881 Modem, MediaTek Mt6881 Firmware, MediaTek Mt6897, MediaTek Mt6897 Firmware, MediaTek Mt6899, MediaTek Mt6899 Firmware, MediaTek Mt6982vb, MediaTek Mt6982vb Firmware, MediaTek Mt6986, MediaTek Mt6986 Firmware, MediaTek MT6988, MediaTek Mt6988 Firmware, MediaTek Mt6991, MediaTek Mt6991 Firmware, MediaTek MT6993, MediaTek Mt6993 Firmware, MediaTek Mt8668, MediaTek Mt8668 Firmware, MediaTek MT8676, MediaTek Mt8676 Firmware, MediaTek MT8678, MediaTek Mt8678 Firmware, MediaTek MT8755, MediaTek Mt8755 Firmware, MediaTek MT8775, MediaTek Mt8775 Firmware, MediaTek MT8792, MediaTek Mt8792 Firmware, MediaTek Mt8793, MediaTek Mt8793 Firmware, MediaTek MT8863, MediaTek Mt8863 Firmware, MediaTek MT8873, MediaTek Mt8873 Firmware, MediaTek MT8883, MediaTek Mt8883 Firmware. Vendors: MediaTek.

Quick answers

Is CVE-2026-20500 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20500 being exploited in the wild.
How severe is CVE-2026-20500?
Medium severity, with a CVSS score of 5.5, published 7 September 2026.
Which products and versions are affected?
MediaTek MT2716 Modem All versions prior to patch MOLY01810811; MediaTek MT6835 Modem All versions prior to patch MOLY01810811; MediaTek MT6858 Modem All versions prior to patch MOLY01810811; MediaTek MT6878 Modem All versions prior to patch MOLY01810811; and 18 more.
Is there a fix for CVE-2026-20500?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20500 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-20500?
Check whether you run MediaTek Mt2716, MediaTek MT2716 Modem, MediaTek Mt2716 Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Modem subcomponent due to improper input validation (CWE-295). When the modem receives malformed input, insufficient validation checks fail to prevent a system crash, leading to a denial of service condition. Exploitation requires local access with user-level privileges and user interaction to trigger the crash. The issue affects at least 13 MediaTek chipset models (MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982VB, MT6986, MT6988, MT6991, MT6993, and others). MediaTek has issued patch ID MOLY01810811 and notified OEMs at least two months prior to the September 2026 public disclosure.

Affected products

  • MediaTek MT2716 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6835 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6858 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6878 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6881 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6897 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6899 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6982VB Modem All versions prior to patch MOLY01810811
  • MediaTek MT6986 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6988 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6991 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6993 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8668 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8676 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8678 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8755 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8775 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8792 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8793 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8863 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8873 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8883 Modem All versions prior to patch MOLY01810811

Timeline

  • 2026-09-07: disclosed
  • 2026-09-07: other: Patch ID MOLY01810811 released; OEMs notified at least 2 months prior

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.