CVE-2026-20519: MediaTek Modem out-of-bounds write

CVE-2026-20519 · Severity: high · CVSS 7.5 · Published 2026-10-05

MediaTek modem firmware, used in smartphones and connected devices, contains an out-of-bounds write vulnerability in its cellular communication stack. An attacker operating a rogue cellular base station can trigger this flaw to gain complete control of the device without any user action. This could allow attackers to steal data, deploy malware, or hijack devices on a network.

Technologies: MediaTek MT2716 Modem, MediaTek MT2735 Modem, MediaTek MT2737 Modem, MediaTek MT6813 Modem, MediaTek MT6815 Modem, MediaTek MT6833 Modem, MediaTek MT6835 Modem, MediaTek MT6853 Modem, MediaTek MT6855 Modem, MediaTek MT6858 Modem, MediaTek MT6873 Modem, MediaTek MT6875 Modem, MediaTek MT6877 Modem, MediaTek MT6878 Modem, MediaTek MT6879 Modem, MediaTek MT6880 Modem, MediaTek MT6881 Modem, MediaTek MT6883 Modem, MediaTek MT6885 Modem, MediaTek MT6886 Modem, MediaTek MT6889 Modem, MediaTek MT6890 Modem, MediaTek MT6891 Modem, MediaTek MT6893 Modem, MediaTek MT6895 Modem, MediaTek MT6896 Modem. Vendors: MediaTek.

Quick answers

Is CVE-2026-20519 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20519 being exploited in the wild.
How severe is CVE-2026-20519?
High severity, with a CVSS score of 7.5, published 5 October 2026.
Which products and versions are affected?
MediaTek MT2716 Modem; MediaTek MT2735 Modem; MediaTek MT2737 Modem; MediaTek MT6813 Modem; and 22 more.
Is there a fix for CVE-2026-20519?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20519 attacked?
It is attacked over the network or from the adjacent network, in device firmware.
Am I affected by CVE-2026-20519?
Check whether you run MediaTek MT2716 Modem, MediaTek MT2735 Modem, MediaTek MT2737 Modem or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing bounds check in the modem subcomponent allows an out-of-bounds write (CWE-787) when processing cellular network responses. An attacker controlling a rogue base station can send specially crafted signals to trigger the vulnerability, leading to privilege escalation within the modem firmware. No authentication or user interaction is required for exploitation.

Affected products

  • MediaTek MT2716 Modem
  • MediaTek MT2735 Modem
  • MediaTek MT2737 Modem
  • MediaTek MT6813 Modem
  • MediaTek MT6815 Modem
  • MediaTek MT6833 Modem
  • MediaTek MT6835 Modem
  • MediaTek MT6853 Modem
  • MediaTek MT6855 Modem
  • MediaTek MT6858 Modem
  • MediaTek MT6873 Modem
  • MediaTek MT6875 Modem
  • MediaTek MT6877 Modem
  • MediaTek MT6878 Modem
  • MediaTek MT6879 Modem
  • MediaTek MT6880 Modem
  • MediaTek MT6881 Modem
  • MediaTek MT6883 Modem
  • MediaTek MT6885 Modem
  • MediaTek MT6886 Modem
  • MediaTek MT6889 Modem
  • MediaTek MT6890 Modem
  • MediaTek MT6891 Modem
  • MediaTek MT6893 Modem
  • MediaTek MT6895 Modem
  • MediaTek MT6896 Modem

Timeline

  • 2026-10-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.