What is the CVSS score of CVE-2026-20421?

CVE-2026-20421 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Nr15 are affected by CVE-2026-20421?

CVE-2026-20421 presents notable security risk, a out-of-bounds read vulnerability rated CVSS 6.5. Exploitation could cause memory corruption or application crashes.

How to fix or mitigate CVE-2026-20421?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Nr15 CVE-2026-20421

MEDIUM

Out-of-bounds Read (CWE-125)

2026-02-02 security@mediatek.com

Denial Of Service Nr15

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 02, 2026 - 09:15 nvd

MEDIUM 6.5

DescriptionCVE.org

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01738293; Issue ID: MSV-5922.

AnalysisAI

The Nr15 modem is susceptible to a denial-of-service attack through improper input validation when connecting to a rogue base station, allowing an attacker to trigger a system crash without requiring user interaction or special privileges. An unauthenticated attacker within radio proximity can exploit this vulnerability to render affected modems unresponsive. No patch is currently available for this issue.

Technical ContextAI

Classified as CWE-125 (Out-of-bounds Read). Affects Nr15. In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01738293; Issue ID: MSV-5922.