Junglewise Threat Intelligence

CVE-2026-20500: MediaTek Modem system crash due to improper input validation

CVE-2026-20500 · Severity: medium · CVSS 5.5 · Published 2026-09-07

Technologies: MediaTek Mt6881 Firmware, MediaTek Mt8873 Firmware, MediaTek Mt6878 Firmware, MediaTek Mt6982vb, MediaTek MT6988, MediaTek MT8883, MediaTek MT8873, MediaTek MT8676, MediaTek MT8755, MediaTek Mt6835 Firmware, MediaTek MT8863, MediaTek Mt6993 Firmware, MediaTek Mt6878, MediaTek Mt6991, MediaTek Mt8775 Firmware, MediaTek MT6993, MediaTek Mt8676 Firmware, MediaTek Mt6897, MediaTek MT8792, MediaTek Mt6897 Firmware, MediaTek Mt6835, MediaTek MT8775, MediaTek Mt6986, MediaTek Mt8668, MediaTek Mt8793 Firmware, MediaTek Mt6881, MediaTek Mt6986 Firmware, MediaTek Mt6991 Firmware, MediaTek MT6858, MediaTek Mt8793, MediaTek Mt6899, MediaTek Mt6982vb Firmware, MediaTek Mt6988 Firmware, MediaTek Mt8792 Firmware, MediaTek Mt6858 Firmware, MediaTek Mt8678 Firmware, MediaTek Mt6899 Firmware, MediaTek Mt8755 Firmware, MediaTek Mt8668 Firmware, MediaTek MT8678, MediaTek Mt8883 Firmware. Vendors: MediaTek.

Executive brief

A vulnerability in MediaTek's modem firmware can cause a system crash when processing specially crafted input. The modem is a critical radio component found in smartphones and IoT devices; crashing it causes temporary loss of connectivity and service availability. An attacker with local user privileges and ability to interact with the device can trigger a denial of service.

Technical details

The vulnerability exists in the Modem subcomponent due to improper input validation (CWE-295). When the modem receives malformed input, insufficient validation checks fail to prevent a system crash, leading to a denial of service condition. Exploitation requires local access with user-level privileges and user interaction to trigger the crash. The issue affects at least 13 MediaTek chipset models (MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982VB, MT6986, MT6988, MT6991, MT6993, and others). MediaTek has issued patch ID MOLY01810811 and notified OEMs at least two months prior to the September 2026 public disclosure.

Affected products

  • MediaTek MT2716 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6835 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6858 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6878 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6881 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6897 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6899 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6982VB Modem All versions prior to patch MOLY01810811
  • MediaTek MT6986 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6988 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6991 Modem All versions prior to patch MOLY01810811
  • MediaTek MT6993 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8668 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8676 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8678 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8755 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8775 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8792 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8793 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8863 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8873 Modem All versions prior to patch MOLY01810811
  • MediaTek MT8883 Modem All versions prior to patch MOLY01810811

Timeline

  • 2026-09-07: disclosed
  • 2026-09-07: other: Patch ID MOLY01810811 released; OEMs notified at least 2 months prior

References

Related threats