CVE-2026-20539: MediaTek Modem out of bounds read due to missing bounds check

CVE-2026-20539 · Severity: medium · CVSS 5.3 · Published 2026-10-05

MediaTek modems used in smartphones and other devices contain an out of bounds read vulnerability due to insufficient input validation. An attacker operating a rogue cellular base station can trigger a denial of service condition by sending specially crafted network packets, crashing the modem without requiring the user to take any action or have special privileges.

Technologies: MediaTek MT2716 Modem, MediaTek MT2735 Modem, MediaTek MT2737 Modem, MediaTek MT6813 Modem, MediaTek MT6815 Modem, MediaTek MT6833 Modem, MediaTek MT6835 Modem, MediaTek MT6853 Modem, MediaTek MT6855 Modem, MediaTek MT6858 Modem, MediaTek MT6873 Modem, MediaTek MT6875 Modem, MediaTek MT6877 Modem, MediaTek MT6878 Modem, MediaTek MT6879 Modem, MediaTek MT6880 Modem, MediaTek MT6881 Modem, MediaTek MT6883 Modem, MediaTek MT6885 Modem, MediaTek MT6886 Modem, MediaTek MT6889 Modem, MediaTek MT6890 Modem, MediaTek MT6891 Modem, MediaTek MT6893 Modem, MediaTek MT6895 Modem, MediaTek MT6896 Modem. Vendors: MediaTek.

Quick answers

Is CVE-2026-20539 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20539 being exploited in the wild.
How severe is CVE-2026-20539?
Medium severity, with a CVSS score of 5.3, published 5 October 2026.
Which products and versions are affected?
MediaTek MT2716 Modem; MediaTek MT2735 Modem; MediaTek MT2737 Modem; MediaTek MT6813 Modem; and 22 more.
Is there a fix for CVE-2026-20539?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20539 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2026-20539?
Check whether you run MediaTek MT2716 Modem, MediaTek MT2735 Modem, MediaTek MT2737 Modem or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing bounds check in the modem subcomponent allows an out of bounds read when processing base station communications. The vulnerability is remotely exploitable by an attacker controlling a rogue base station and does not require user interaction or device-level privileges. Successful exploitation causes denial of service through modem crash.

Affected products

  • MediaTek MT2716 Modem
  • MediaTek MT2735 Modem
  • MediaTek MT2737 Modem
  • MediaTek MT6813 Modem
  • MediaTek MT6815 Modem
  • MediaTek MT6833 Modem
  • MediaTek MT6835 Modem
  • MediaTek MT6853 Modem
  • MediaTek MT6855 Modem
  • MediaTek MT6858 Modem
  • MediaTek MT6873 Modem
  • MediaTek MT6875 Modem
  • MediaTek MT6877 Modem
  • MediaTek MT6878 Modem
  • MediaTek MT6879 Modem
  • MediaTek MT6880 Modem
  • MediaTek MT6881 Modem
  • MediaTek MT6883 Modem
  • MediaTek MT6885 Modem
  • MediaTek MT6886 Modem
  • MediaTek MT6889 Modem
  • MediaTek MT6890 Modem
  • MediaTek MT6891 Modem
  • MediaTek MT6893 Modem
  • MediaTek MT6895 Modem
  • MediaTek MT6896 Modem

Timeline

  • 2026-10-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.