CVE-2026-20525

Analyzed Analyzed - Analysis Complete

Modem Improper Input Validation Remote DoS Vulnerability

Publication date: 2026-10-05

Last updated on: 2026-10-08

Assigner: MediaTek, Inc.

Description

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01870473 / MOLY00814393; Issue ID: MSV-9041.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-20525

EUVD

EUVD-2026-92202

Affected Vendors & Products

Vendor	Product	Version / Range
mediatek	mt2716_firmware	*
mediatek	mt6835_firmware	*
mediatek	mt6858_firmware	*
mediatek	mt6878_firmware	*
mediatek	mt6881_firmware	*
mediatek	mt6897_firmware	*
mediatek	mt6899_firmware	*
mediatek	mt6982_firmware	*
mediatek	mt6986_firmware	*
mediatek	mt6988_firmware	*
mediatek	mt6991_firmware	*
mediatek	mt6993_firmware	*
mediatek	mt8668_firmware	*
mediatek	mt8676_firmware	*
mediatek	mt8678_firmware	*
mediatek	mt8755_firmware	*
mediatek	mt8775_firmware	*
mediatek	mt8792_firmware	*
mediatek	mt8793_firmware	*
mediatek	mt8863_firmware	*
mediatek	mt8873_firmware	*
mediatek	mt8883_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability in the Mediatek modem allows a remote denial of service attack. It occurs due to improper input validation, which can cause the system to crash. Exploitation requires a user equipment (UE) to connect to a malicious base station controlled by the attacker, without needing additional privileges or user interaction.

Impact Analysis

If exploited, this vulnerability could cause your device to crash or become unresponsive, leading to a loss of connectivity or functionality. Since it enables remote denial of service, attackers could disrupt your device's normal operation without direct access.

Compliance Impact

This vulnerability could lead to remote denial of service, potentially disrupting services that handle sensitive data. While not directly violating GDPR or HIPAA, such disruptions may impact compliance by affecting availability of personal or health data systems.

Mitigation Strategies

Apply the provided patches (MOLY01870473 or MOLY00814393) to address the improper input validation issue in the Modem component. Ensure your system is updated to the latest firmware version to prevent remote denial of service attacks via rogue base stations.

Hi! I’m here to help you understand CVE-2026-20525. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70