CVE-2026-20526: mediatek, inc. mediatek chipset Out-of-bounds Write

Vulnerability summary

CVE-2026-20526 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in mediatek, inc. mediatek chipset. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.7% of scored vulnerabilities.

Timeline

1. 05-10-2026
   PublishedVulnerability first disclosed.
2. 06-10-2026
   Last modifiedVulnerability information updated.

Description

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01898195; Issue ID: MSV-8906.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.