Skip to main content

MediaTek Modem EUVDEUVD-2026-72196

| CVE-2026-20503 MEDIUM
Reachable Assertion (CWE-617)
2026-09-07 MediaTek GHSA-x74h-78mc-6jq7
5.3
CVSS 3.1 · Vendor: MediaTek
Share

Severity by source

Vendor (MediaTek) PRIMARY
5.3 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.3 MEDIUM

AV:A because rogue base station must be in radio range; AC:H for SDR/rogue-cell setup complexity; availability-only crash with no C or I impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (MediaTek).

CVSS VectorVendor: MediaTek

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Sep 07, 2026 - 11:31 vuln.today
CVE Published
Sep 07, 2026 - 01:57 cve.org
MEDIUM 5.3
CVE Published
Sep 07, 2026 - 01:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01371002; Issue ID: MSV-9020.

AnalysisAI

Remote denial of service against MediaTek modem firmware affects 57+ chipset variants spanning the MT6xxx and MT8xxx series when a user equipment (UE) connects to an attacker-controlled rogue base station, triggering a missing bounds check (CWE-617 reachable assertion) that crashes the modem subsystem. The attack requires no privileges or user interaction on the victim device, though the adjacent network vector (AV:A/AC:H) demands the attacker operate specialized RF equipment in physical proximity. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden

Vulnerability AssessmentAI

Exploitation Exploitation requires a UE running unpatched MOLY modem firmware on one of the 57 listed MediaTek chipsets (MT2716 through MT8893 series) to have connected to an attacker-controlled rogue base station. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 5.3 (Medium) with AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the constrained threat model: impact is availability-only (modem crash, device DoS), there is no confidentiality or integrity compromise, and the adjacent attack vector requires the attacker to physically operate a rogue base station with SDR or equivalent RF equipment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation MediaTek has released a fix under Patch ID MOLY01371002 (Issue ID MSV-9020), documented in the September 2026 MediaTek Security Bulletin at https://www.mediatek.com/product-security-bulletin/September-2026. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-20433 HIGH
8.8 Apr 07

Out-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont

CVE-2026-20501 HIGH
8.4 Sep 07

Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta

CVE-2026-20502 HIGH
8.4 Sep 07

Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian

CVE-2026-20465 HIGH
8.1 Aug 03

Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi

CVE-2026-20432 HIGH
8.0 Apr 07

Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con

CVE-2026-20452 HIGH
8.0 Jun 01

Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user

CVE-2026-20495 HIGH
7.8 Aug 03

Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT

CVE-2026-20455 HIGH
7.8 Jun 01

Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain

CVE-2026-20483 HIGH
7.7 Aug 03

Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of

CVE-2026-20479 HIGH
7.5 Aug 03

Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment

CVE-2026-20458 HIGH
7.5 Jul 01

Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a

CVE-2026-20510 MEDIUM
6.7 Sep 07

Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,

Share

EUVD-2026-72196 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy