Junglewise Threat Intelligence
CVE-2026-20503: MediaTek Modem system crash due to missing bounds check
CVE-2026-20503 · Severity: medium · CVSS 5.3 · Published 2026-09-07
Technologies: MediaTek Mt6983, MediaTek Mt6885 Firmware, MediaTek Mt6880 Firmware, MediaTek Mt6982vb Firmware, MediaTek Mt6890, MediaTek Mt6881 Firmware, MediaTek Mt8797 Firmware, MediaTek Mt8873 Firmware, MediaTek Mt6990 Firmware, MediaTek MT8791, MediaTek Mt6878 Firmware, MediaTek Mt6880, MediaTek MT6988, MediaTek Mt6813 Firmware, MediaTek Mt6895 Firmware, MediaTek MT8883, MediaTek Mt8675, MediaTek Mt6879, MediaTek Mt6988 Firmware, MediaTek Mt6885, MediaTek Mt6873 Firmware, MediaTek Mt6989 Firmware, MediaTek Mt8675 Firmware, MediaTek Mt6886, MediaTek MT8873, MediaTek MT8676, MediaTek MT8755, MediaTek Mt6835 Firmware, MediaTek MT8863, MediaTek Mt6855 Firmware, MediaTek Mt6883, MediaTek Mt6993 Firmware, MediaTek Mt6875, MediaTek Mt8791t, MediaTek Mt6878, MediaTek Mt6991, MediaTek Mt2737 Firmware, MediaTek Mt6879 Firmware, MediaTek Mt8775 Firmware, MediaTek MT6993, MediaTek Mt6982vb, MediaTek Mt6855, MediaTek MT6813, MediaTek Mt8798, MediaTek Mt8771, MediaTek Mt6877 Firmware, MediaTek Mt8676 Firmware, MediaTek Mt6897, MediaTek Mt8791t Firmware, MediaTek Mt6877, MediaTek Mt6985 Firmware, MediaTek Mt6881, MediaTek MT8792, MediaTek Mt6897 Firmware, MediaTek Mt6833 Firmware, MediaTek Mt6853 Firmware, MediaTek Mt6835, MediaTek MT8775, MediaTek Mt6889, MediaTek Mt6986, MediaTek Mt8668, MediaTek Mt8797, MediaTek Mt8793 Firmware, MediaTek Mt6853, MediaTek Mt6886 Firmware, MediaTek Mt6983 Firmware, MediaTek Mt8791 Firmware, MediaTek Mt2735 Firmware, MediaTek Mt6986 Firmware, MediaTek Mt6991 Firmware, MediaTek MT6858, MediaTek Mt8793, MediaTek MT8893, MediaTek Mt8771 Firmware, MediaTek MT2735, MediaTek Modem, MediaTek Mt6899, MediaTek Mt6889 Firmware, MediaTek MT6891, MediaTek Mt6890 Firmware, MediaTek Mt8792 Firmware, MediaTek MT6990, MediaTek Mt6858 Firmware, MediaTek MT8796, MediaTek Mt8796 Firmware, MediaTek MT6833, MediaTek Mt8678 Firmware, MediaTek Mt6899 Firmware, MediaTek Mt6895, MediaTek Mt8755 Firmware, MediaTek Mt8668 Firmware, MediaTek MT2737, MediaTek Mt6891 Firmware, MediaTek Mt6985, MediaTek Mt6875 Firmware, MediaTek Mt6989, MediaTek Mt6893 Firmware, MediaTek MT8678, MediaTek Mt8883 Firmware, MediaTek Mt6893, MediaTek Mt6883 Firmware, MediaTek MT6873. Vendors: MediaTek.
Executive brief
MediaTek's modem component, which handles cellular connectivity in smartphones and IoT devices, contains a flaw that allows attackers to crash the system by setting up a rogue base station. An attacker can remotely trigger a denial of service without needing device credentials or user interaction, potentially disrupting communication and device functionality for affected users.
Technical details
A missing bounds check in the MediaTek modem subcomponent allows an out-of-bounds memory access that causes a system crash. The vulnerability can be exploited remotely when a user equipment (UE) connects to an attacker-controlled rogue base station; no additional privileges or user interaction is required. An attacker can achieve a remote denial of service condition. A security patch is available (Patch ID: MOLY01371002).
Affected products
- MediaTek Modem MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982VB, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8883
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Patch ID: MOLY01371002