# CVE-2026-20503: MediaTek Modem system crash due to missing bounds check

Source: https://junglewise.ai/threats/cve-2026-20503-mediatek-modem-system-crash-due-to-missing-bounds-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-20503 · Severity: medium · CVSS 5.3 · Published 2026-09-07

MediaTek's modem component, which handles cellular connectivity in smartphones and IoT devices, contains a flaw that allows attackers to crash the system by setting up a rogue base station. An attacker can remotely trigger a denial of service without needing device credentials or user interaction, potentially disrupting communication and device functionality for affected users.

Technologies: [MediaTek Modem](https://junglewise.ai/threats/technologies/modem), [MediaTek Mt2716](https://junglewise.ai/threats/technologies/mt2716), [MediaTek MT2735](https://junglewise.ai/threats/technologies/mt2735), [MediaTek Mt2735 Firmware](https://junglewise.ai/threats/technologies/mt2735-firmware), [MediaTek MT2737](https://junglewise.ai/threats/technologies/mt2737), [MediaTek Mt2737 Firmware](https://junglewise.ai/threats/technologies/mt2737-firmware), [MediaTek MT6813](https://junglewise.ai/threats/technologies/mt6813), [MediaTek Mt6813 Firmware](https://junglewise.ai/threats/technologies/mt6813-firmware), [MediaTek MT6833](https://junglewise.ai/threats/technologies/mt6833), [MediaTek Mt6833 Firmware](https://junglewise.ai/threats/technologies/mt6833-firmware), [MediaTek Mt6835](https://junglewise.ai/threats/technologies/mt6835), [MediaTek Mt6835 Firmware](https://junglewise.ai/threats/technologies/mt6835-firmware), [MediaTek Mt6853](https://junglewise.ai/threats/technologies/mt6853), [MediaTek Mt6853 Firmware](https://junglewise.ai/threats/technologies/mt6853-firmware), [MediaTek Mt6855](https://junglewise.ai/threats/technologies/mt6855), [MediaTek Mt6855 Firmware](https://junglewise.ai/threats/technologies/mt6855-firmware), [MediaTek MT6858](https://junglewise.ai/threats/technologies/mt6858), [MediaTek Mt6858 Firmware](https://junglewise.ai/threats/technologies/mt6858-firmware), [MediaTek MT6873](https://junglewise.ai/threats/technologies/mt6873), [MediaTek Mt6873 Firmware](https://junglewise.ai/threats/technologies/mt6873-firmware), [MediaTek Mt6875](https://junglewise.ai/threats/technologies/mt6875), [MediaTek Mt6875 Firmware](https://junglewise.ai/threats/technologies/mt6875-firmware), [MediaTek Mt6877](https://junglewise.ai/threats/technologies/mt6877), [MediaTek Mt6877 Firmware](https://junglewise.ai/threats/technologies/mt6877-firmware), [MediaTek Mt6878](https://junglewise.ai/threats/technologies/mt6878), [MediaTek Mt6878 Firmware](https://junglewise.ai/threats/technologies/mt6878-firmware), [MediaTek Mt6879](https://junglewise.ai/threats/technologies/mt6879), [MediaTek Mt6879 Firmware](https://junglewise.ai/threats/technologies/mt6879-firmware), [MediaTek Mt6880](https://junglewise.ai/threats/technologies/mt6880), [MediaTek Mt6880 Firmware](https://junglewise.ai/threats/technologies/mt6880-firmware), [MediaTek Mt6881](https://junglewise.ai/threats/technologies/mt6881), [MediaTek Mt6881 Firmware](https://junglewise.ai/threats/technologies/mt6881-firmware), [MediaTek Mt6883](https://junglewise.ai/threats/technologies/mt6883), [MediaTek Mt6883 Firmware](https://junglewise.ai/threats/technologies/mt6883-firmware), [MediaTek Mt6885](https://junglewise.ai/threats/technologies/mt6885), [MediaTek Mt6885 Firmware](https://junglewise.ai/threats/technologies/mt6885-firmware), [MediaTek Mt6886](https://junglewise.ai/threats/technologies/mt6886), [MediaTek Mt6886 Firmware](https://junglewise.ai/threats/technologies/mt6886-firmware), [MediaTek Mt6889](https://junglewise.ai/threats/technologies/mt6889), [MediaTek Mt6889 Firmware](https://junglewise.ai/threats/technologies/mt6889-firmware), [MediaTek Mt6890](https://junglewise.ai/threats/technologies/mt6890), [MediaTek Mt6890 Firmware](https://junglewise.ai/threats/technologies/mt6890-firmware), [MediaTek MT6891](https://junglewise.ai/threats/technologies/mt6891), [MediaTek Mt6891 Firmware](https://junglewise.ai/threats/technologies/mt6891-firmware), [MediaTek Mt6893](https://junglewise.ai/threats/technologies/mt6893), [MediaTek Mt6893 Firmware](https://junglewise.ai/threats/technologies/mt6893-firmware), [MediaTek Mt6895](https://junglewise.ai/threats/technologies/mt6895), [MediaTek Mt6895 Firmware](https://junglewise.ai/threats/technologies/mt6895-firmware), [MediaTek MT6896](https://junglewise.ai/threats/technologies/mt6896), [MediaTek Mt6896 Firmware](https://junglewise.ai/threats/technologies/mt6896-firmware), [MediaTek Mt6897](https://junglewise.ai/threats/technologies/mt6897), [MediaTek Mt6897 Firmware](https://junglewise.ai/threats/technologies/mt6897-firmware), [MediaTek Mt6899](https://junglewise.ai/threats/technologies/mt6899), [MediaTek Mt6899 Firmware](https://junglewise.ai/threats/technologies/mt6899-firmware), [MediaTek MT6980](https://junglewise.ai/threats/technologies/mt6980), [MediaTek Mt6980 Firmware](https://junglewise.ai/threats/technologies/mt6980-firmware), [MediaTek Mt6982vb](https://junglewise.ai/threats/technologies/mt6982vb), [MediaTek Mt6982vb Firmware](https://junglewise.ai/threats/technologies/mt6982vb-firmware), [MediaTek Mt6983](https://junglewise.ai/threats/technologies/mt6983), [MediaTek Mt6983 Firmware](https://junglewise.ai/threats/technologies/mt6983-firmware), [MediaTek Mt6985](https://junglewise.ai/threats/technologies/mt6985), [MediaTek Mt6985 Firmware](https://junglewise.ai/threats/technologies/mt6985-firmware), [MediaTek Mt6986](https://junglewise.ai/threats/technologies/mt6986), [MediaTek Mt6986 Firmware](https://junglewise.ai/threats/technologies/mt6986-firmware), [MediaTek MT6988](https://junglewise.ai/threats/technologies/mt6988), [MediaTek Mt6988 Firmware](https://junglewise.ai/threats/technologies/mt6988-firmware), [MediaTek Mt6989](https://junglewise.ai/threats/technologies/mt6989), [MediaTek Mt6989 Firmware](https://junglewise.ai/threats/technologies/mt6989-firmware), [MediaTek MT6990](https://junglewise.ai/threats/technologies/mt6990), [MediaTek Mt6990 Firmware](https://junglewise.ai/threats/technologies/mt6990-firmware), [MediaTek Mt6991](https://junglewise.ai/threats/technologies/mt6991), [MediaTek Mt6991 Firmware](https://junglewise.ai/threats/technologies/mt6991-firmware), [MediaTek MT6993](https://junglewise.ai/threats/technologies/mt6993), [MediaTek Mt6993 Firmware](https://junglewise.ai/threats/technologies/mt6993-firmware), [MediaTek Mt8668](https://junglewise.ai/threats/technologies/mt8668), [MediaTek Mt8668 Firmware](https://junglewise.ai/threats/technologies/mt8668-firmware), [MediaTek Mt8673](https://junglewise.ai/threats/technologies/mt8673), [MediaTek Mt8673 Firmware](https://junglewise.ai/threats/technologies/mt8673-firmware), [MediaTek Mt8675](https://junglewise.ai/threats/technologies/mt8675), [MediaTek Mt8675 Firmware](https://junglewise.ai/threats/technologies/mt8675-firmware), [MediaTek MT8676](https://junglewise.ai/threats/technologies/mt8676), [MediaTek Mt8676 Firmware](https://junglewise.ai/threats/technologies/mt8676-firmware), [MediaTek MT8678](https://junglewise.ai/threats/technologies/mt8678), [MediaTek Mt8678 Firmware](https://junglewise.ai/threats/technologies/mt8678-firmware), [MediaTek MT8755](https://junglewise.ai/threats/technologies/mt8755), [MediaTek Mt8755 Firmware](https://junglewise.ai/threats/technologies/mt8755-firmware), [MediaTek Mt8771](https://junglewise.ai/threats/technologies/mt8771), [MediaTek Mt8771 Firmware](https://junglewise.ai/threats/technologies/mt8771-firmware), [MediaTek MT8775](https://junglewise.ai/threats/technologies/mt8775), [MediaTek Mt8775 Firmware](https://junglewise.ai/threats/technologies/mt8775-firmware), [MediaTek MT8791](https://junglewise.ai/threats/technologies/mt8791), [MediaTek Mt8791 Firmware](https://junglewise.ai/threats/technologies/mt8791-firmware), [MediaTek Mt8791t](https://junglewise.ai/threats/technologies/mt8791t), [MediaTek Mt8791t Firmware](https://junglewise.ai/threats/technologies/mt8791t-firmware), [MediaTek MT8792](https://junglewise.ai/threats/technologies/mt8792), [MediaTek Mt8792 Firmware](https://junglewise.ai/threats/technologies/mt8792-firmware), [MediaTek Mt8793](https://junglewise.ai/threats/technologies/mt8793), [MediaTek Mt8793 Firmware](https://junglewise.ai/threats/technologies/mt8793-firmware), [MediaTek MT8795T](https://junglewise.ai/threats/technologies/mt8795t), [MediaTek Mt8795t Firmware](https://junglewise.ai/threats/technologies/mt8795t-firmware), [MediaTek MT8796](https://junglewise.ai/threats/technologies/mt8796), [MediaTek Mt8796 Firmware](https://junglewise.ai/threats/technologies/mt8796-firmware), [MediaTek Mt8797](https://junglewise.ai/threats/technologies/mt8797), [MediaTek Mt8797 Firmware](https://junglewise.ai/threats/technologies/mt8797-firmware), [MediaTek Mt8798](https://junglewise.ai/threats/technologies/mt8798), [MediaTek Mt8798 Firmware](https://junglewise.ai/threats/technologies/mt8798-firmware), [MediaTek MT8863](https://junglewise.ai/threats/technologies/mt8863), [MediaTek Mt8863 Firmware](https://junglewise.ai/threats/technologies/mt8863-firmware), [MediaTek MT8873](https://junglewise.ai/threats/technologies/mt8873), [MediaTek Mt8873 Firmware](https://junglewise.ai/threats/technologies/mt8873-firmware), [MediaTek MT8883](https://junglewise.ai/threats/technologies/mt8883), [MediaTek Mt8883 Firmware](https://junglewise.ai/threats/technologies/mt8883-firmware), [MediaTek MT8893](https://junglewise.ai/threats/technologies/mt8893), [MediaTek Mt8893 Firmware](https://junglewise.ai/threats/technologies/mt8893-firmware). Vendors: [MediaTek](https://junglewise.ai/threats/vendors/mediatek).

## Quick answers

**Is CVE-2026-20503 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20503 being exploited in the wild.

**How severe is CVE-2026-20503?** Medium severity, with a CVSS score of 5.3, published 7 September 2026.

**Which products and versions are affected?** MediaTek Modem MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982VB, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8883.

**Is there a fix for CVE-2026-20503?** A patch was published on 2026-09-07: Patch ID: MOLY01371002 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20503 attacked?** It is attacked over the network or from the adjacent network, in device firmware.

**Am I affected by CVE-2026-20503?** Check whether you run MediaTek Modem, MediaTek Mt2716, MediaTek Mt2716 Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing bounds check in the MediaTek modem subcomponent allows an out-of-bounds memory access that causes a system crash. The vulnerability can be exploited remotely when a user equipment (UE) connects to an attacker-controlled rogue base station; no additional privileges or user interaction is required. An attacker can achieve a remote denial of service condition. A security patch is available (Patch ID: MOLY01371002).

## Affected products

- MediaTek Modem MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982VB, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8883

## Timeline

- 2026-09-07: disclosed
- 2026-09-07: patched: Patch ID: MOLY01371002

## References

- [https://www.mediatek.com/product-security-bulletin/September-2026](https://www.mediatek.com/product-security-bulletin/September-2026)

## Related threats

- [MediaTek Modem privilege escalation via permissions bypass](https://junglewise.ai/threats/cve-2026-68591-in-modem-there-is-a-possible-escalation-of-privilege-due-to-a)
- [MediaTek Modem out-of-bounds write privilege escalation](https://junglewise.ai/threats/cve-2026-68589-in-modem-there-is-a-possible-out-of-bounds-write-due-to-a-missing)
- [MediaTek Modem integer overflow denial of service](https://junglewise.ai/threats/cve-2026-68588-in-modem-there-is-a-possible-way-for-xxx-to-xxxxx-due-to-an)
- [MediaTek Modem logic error denial of service](https://junglewise.ai/threats/cve-2026-20600-in-modem-there-is-a-possible-application-crash-due-to-a-logic)
- [MediaTek Modem privilege escalation due to missing permission check](https://junglewise.ai/threats/cve-2026-20599-in-modem-there-is-a-possible-escalation-of-privilege-due-to-a)