CVE-2026-20538: MediaTek Modem out-of-bounds read due to missing permission check

CVE-2026-20538 · Severity: medium · CVSS 5.3 · Published 2026-10-05

MediaTek's modem component, which handles cellular communications in smartphones and IoT devices, contains an out-of-bounds read vulnerability caused by insufficient permission validation. An attacker operating a rogue cellular base station can trigger a denial of service by causing the device to crash or freeze without requiring any user interaction or special privileges. This affects numerous MediaTek chipsets used in devices worldwide.

Technologies: MediaTek Mt2716, MediaTek MT2735, MediaTek MT2737, MediaTek MT6813, MediaTek Mt6815, MediaTek MT6833, MediaTek Mt6835, MediaTek Mt6853, MediaTek Mt6855, MediaTek MT6858, MediaTek MT6873, MediaTek Mt6875, MediaTek Mt6877, MediaTek Mt6878, MediaTek Mt6879, MediaTek Mt6880, MediaTek Mt6881, MediaTek Mt6883, MediaTek Mt6885, MediaTek Mt6886, MediaTek Mt6889, MediaTek Mt6890, MediaTek MT6891, MediaTek Mt6893, MediaTek Mt6895, MediaTek MT6896. Vendors: MediaTek.

Quick answers

Is CVE-2026-20538 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20538 being exploited in the wild.
How severe is CVE-2026-20538?
Medium severity, with a CVSS score of 5.3, published 5 October 2026.
Which products and versions are affected?
MediaTek MT2716; MediaTek MT2735; MediaTek MT2737; MediaTek MT6813; and 22 more.
Is there a fix for CVE-2026-20538?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20538 attacked?
It is attacked over the network or from the adjacent network, in device firmware.
Am I affected by CVE-2026-20538?
Check whether you run MediaTek Mt2716, MediaTek MT2735, MediaTek MT2737 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing bounds check in the modem subcomponent that allows out-of-bounds memory reads when processing cellular signals. An attacker can exploit this by operating a rogue base station that the device connects to, sending specially crafted signals to trigger the out-of-bounds access without requiring valid credentials or user interaction. The impact is remote denial of service; a patch is available from MediaTek.

Affected products

  • MediaTek MT2716
  • MediaTek MT2735
  • MediaTek MT2737
  • MediaTek MT6813
  • MediaTek MT6815
  • MediaTek MT6833
  • MediaTek MT6835
  • MediaTek MT6853
  • MediaTek MT6855
  • MediaTek MT6858
  • MediaTek MT6873
  • MediaTek MT6875
  • MediaTek MT6877
  • MediaTek MT6878
  • MediaTek MT6879
  • MediaTek MT6880
  • MediaTek MT6881
  • MediaTek MT6883
  • MediaTek MT6885
  • MediaTek MT6886
  • MediaTek MT6889
  • MediaTek MT6890
  • MediaTek MT6891
  • MediaTek MT6893
  • MediaTek MT6895
  • MediaTek MT6896

Timeline

  • 2026-10-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.