# CVE-2026-20504: MediaTek Modem denial of service due to missing bounds check Source: https://junglewise.ai/threats/cve-2026-20504-mediatek-modem-denial-of-service-due-to-missing-bounds-check Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-09-07. Updated: 2026-09-26 License: CC BY 4.0 with a link back CVE-2026-20504 · Severity: medium · CVSS 5.3 · Published 2026-09-07 MediaTek modems are communication processors used in smartphones and IoT devices to handle cellular connectivity. A missing bounds check in the modem firmware can cause a system crash when a device connects to a rogue base station controlled by an attacker, resulting in service disruption. No special privileges or user interaction are required to exploit this vulnerability. Technologies: [MediaTek Modem](https://junglewise.ai/threats/technologies/modem), [MediaTek MT2735](https://junglewise.ai/threats/technologies/mt2735), [MediaTek Mt2735 Firmware](https://junglewise.ai/threats/technologies/mt2735-firmware), [MediaTek MT6833](https://junglewise.ai/threats/technologies/mt6833), [MediaTek Mt6833 Firmware](https://junglewise.ai/threats/technologies/mt6833-firmware), [MediaTek Mt6853](https://junglewise.ai/threats/technologies/mt6853), [MediaTek Mt6853 Firmware](https://junglewise.ai/threats/technologies/mt6853-firmware), [MediaTek Mt6855](https://junglewise.ai/threats/technologies/mt6855), [MediaTek Mt6855 Firmware](https://junglewise.ai/threats/technologies/mt6855-firmware), [MediaTek MT6873](https://junglewise.ai/threats/technologies/mt6873), [MediaTek Mt6873 Firmware](https://junglewise.ai/threats/technologies/mt6873-firmware), [MediaTek Mt6875](https://junglewise.ai/threats/technologies/mt6875), [MediaTek Mt6875 Firmware](https://junglewise.ai/threats/technologies/mt6875-firmware), [MediaTek Mt6877](https://junglewise.ai/threats/technologies/mt6877), [MediaTek Mt6877 Firmware](https://junglewise.ai/threats/technologies/mt6877-firmware), [MediaTek Mt6880](https://junglewise.ai/threats/technologies/mt6880), [MediaTek Mt6880 Firmware](https://junglewise.ai/threats/technologies/mt6880-firmware), [MediaTek Mt6883](https://junglewise.ai/threats/technologies/mt6883), [MediaTek Mt6883 Firmware](https://junglewise.ai/threats/technologies/mt6883-firmware), [MediaTek Mt6885](https://junglewise.ai/threats/technologies/mt6885), [MediaTek Mt6885 Firmware](https://junglewise.ai/threats/technologies/mt6885-firmware), [MediaTek Mt6889](https://junglewise.ai/threats/technologies/mt6889), [MediaTek Mt6889 Firmware](https://junglewise.ai/threats/technologies/mt6889-firmware), [MediaTek Mt6890](https://junglewise.ai/threats/technologies/mt6890), [MediaTek Mt6890 Firmware](https://junglewise.ai/threats/technologies/mt6890-firmware), [MediaTek MT6891](https://junglewise.ai/threats/technologies/mt6891), [MediaTek Mt6891 Firmware](https://junglewise.ai/threats/technologies/mt6891-firmware), [MediaTek Mt6893](https://junglewise.ai/threats/technologies/mt6893), [MediaTek Mt6893 Firmware](https://junglewise.ai/threats/technologies/mt6893-firmware), [MediaTek Mt8675](https://junglewise.ai/threats/technologies/mt8675), [MediaTek Mt8675 Firmware](https://junglewise.ai/threats/technologies/mt8675-firmware), [MediaTek Mt8771](https://junglewise.ai/threats/technologies/mt8771), [MediaTek Mt8771 Firmware](https://junglewise.ai/threats/technologies/mt8771-firmware), [MediaTek MT8791](https://junglewise.ai/threats/technologies/mt8791), [MediaTek Mt8791 Firmware](https://junglewise.ai/threats/technologies/mt8791-firmware), [MediaTek Mt8791t](https://junglewise.ai/threats/technologies/mt8791t), [MediaTek Mt8791t Firmware](https://junglewise.ai/threats/technologies/mt8791t-firmware), [MediaTek Mt8797](https://junglewise.ai/threats/technologies/mt8797), [MediaTek Mt8797 Firmware](https://junglewise.ai/threats/technologies/mt8797-firmware). Vendors: [MediaTek](https://junglewise.ai/threats/vendors/mediatek). ## Quick answers **Is CVE-2026-20504 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20504 being exploited in the wild. **How severe is CVE-2026-20504?** Medium severity, with a CVSS score of 5.3, published 7 September 2026. **Which products and versions are affected?** MediaTek Modem MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982VB, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8883. **Is there a fix for CVE-2026-20504?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-20504 attacked?** It is attacked over the network, in device firmware. **Am I affected by CVE-2026-20504?** Check whether you run MediaTek Modem, MediaTek MT2735, MediaTek Mt2735 Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details This vulnerability is a denial-of-service flaw caused by improper bounds checking in the modem subcomponent, allowing an out-of-bounds memory access or crash condition. The attack is triggered over the network when a user equipment (UE) connects to a malicious base station controlled by the attacker. The attacker sends specially crafted input that bypasses validation, causing the modem to crash and temporarily disabling cellular connectivity. No authentication or elevated privileges are required, and the attack succeeds without any user interaction. A patch is available (MOLY00755024). ## Affected products - MediaTek Modem MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982VB, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8883 ## Timeline - 2026-09-07: disclosed ## References - [https://www.mediatek.com/product-security-bulletin/September-2026](https://www.mediatek.com/product-security-bulletin/September-2026) ## Related threats - [MediaTek Modem privilege escalation via permissions bypass](https://junglewise.ai/threats/cve-2026-68591-in-modem-there-is-a-possible-escalation-of-privilege-due-to-a) - [MediaTek Modem out-of-bounds write privilege escalation](https://junglewise.ai/threats/cve-2026-68589-in-modem-there-is-a-possible-out-of-bounds-write-due-to-a-missing) - [MediaTek Modem integer overflow denial of service](https://junglewise.ai/threats/cve-2026-68588-in-modem-there-is-a-possible-way-for-xxx-to-xxxxx-due-to-an) - [MediaTek Modem logic error denial of service](https://junglewise.ai/threats/cve-2026-20600-in-modem-there-is-a-possible-application-crash-due-to-a-logic) - [MediaTek Modem privilege escalation due to missing permission check](https://junglewise.ai/threats/cve-2026-20599-in-modem-there-is-a-possible-escalation-of-privilege-due-to-a)