CVE-2026-20526: MediaTek Modem out-of-bounds write

CVE-2026-20526 · Severity: high · CVSS 7.5 · Published 2026-10-05

MediaTek modems in smartphones and IoT devices process cellular network signals; an out-of-bounds write vulnerability in the modem firmware allows remote privilege escalation when a device connects to an attacker-controlled base station. An attacker can exploit this to gain elevated system privileges and potentially take complete control of the affected device, intercepting communications or installing malware.

Technologies: MediaTek MT2716 Modem, MediaTek MT2735 Modem, MediaTek MT2737 Modem, MediaTek MT6813 Modem, MediaTek MT6815 Modem, MediaTek MT6833 Modem, MediaTek MT6835 Modem, MediaTek MT6853 Modem, MediaTek MT6855 Modem, MediaTek MT6858 Modem, MediaTek MT6873 Modem, MediaTek MT6875 Modem, MediaTek MT6877 Modem, MediaTek MT6878 Modem, MediaTek MT6879 Modem, MediaTek MT6880 Modem, MediaTek MT6881 Modem, MediaTek MT6883 Modem, MediaTek MT6885 Modem, MediaTek MT6886 Modem, MediaTek MT6889 Modem, MediaTek MT6890 Modem, MediaTek MT6891 Modem, MediaTek MT6893 Modem, MediaTek MT6895 Modem, MediaTek MT6896 Modem. Vendors: MediaTek.

Quick answers

Is CVE-2026-20526 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20526 being exploited in the wild.
How severe is CVE-2026-20526?
High severity, with a CVSS score of 7.5, published 5 October 2026.
Which products and versions are affected?
MediaTek MT2716 Modem Unspecified; MediaTek MT2735 Modem Unspecified; MediaTek MT2737 Modem Unspecified; MediaTek MT6813 Modem Unspecified; and 22 more.
Is there a fix for CVE-2026-20526?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20526 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2026-20526?
Check whether you run MediaTek MT2716 Modem, MediaTek MT2735 Modem, MediaTek MT2737 Modem or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing bounds check in the modem subcomponent permits out-of-bounds write access (CWE-787), exploitable via a rogue base station without requiring user execution privileges. The attack requires the user equipment to connect to the attacker-controlled base station. Successful exploitation results in privilege escalation within the modem firmware and a patched firmware version is available.

Affected products

  • MediaTek MT2716 Modem Unspecified
  • MediaTek MT2735 Modem Unspecified
  • MediaTek MT2737 Modem Unspecified
  • MediaTek MT6813 Modem Unspecified
  • MediaTek MT6815 Modem Unspecified
  • MediaTek MT6833 Modem Unspecified
  • MediaTek MT6835 Modem Unspecified
  • MediaTek MT6853 Modem Unspecified
  • MediaTek MT6855 Modem Unspecified
  • MediaTek MT6858 Modem Unspecified
  • MediaTek MT6873 Modem Unspecified
  • MediaTek MT6875 Modem Unspecified
  • MediaTek MT6877 Modem Unspecified
  • MediaTek MT6878 Modem Unspecified
  • MediaTek MT6879 Modem Unspecified
  • MediaTek MT6880 Modem Unspecified
  • MediaTek MT6881 Modem Unspecified
  • MediaTek MT6883 Modem Unspecified
  • MediaTek MT6885 Modem Unspecified
  • MediaTek MT6886 Modem Unspecified
  • MediaTek MT6889 Modem Unspecified
  • MediaTek MT6890 Modem Unspecified
  • MediaTek MT6891 Modem Unspecified
  • MediaTek MT6893 Modem Unspecified
  • MediaTek MT6895 Modem Unspecified
  • MediaTek MT6896 Modem Unspecified

Timeline

  • 2026-10-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.