CVE-2026-20585

Received Received - Intake

Out-of-Bounds Write in Modem Firmware

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: MediaTek, Inc.

Description

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01338165; Issue ID: MSV-9660.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-02

Last Modified

2026-11-02

Generated

2026-11-02

AI Q&A

2026-11-02

EPSS Evaluated

N/A

NVD

CVE-2026-20585

Affected Vendors & Products

Vendor	Product	Version / Range
MediaTek, Inc.	MediaTek chipset	MT2716
MediaTek, Inc.	MediaTek chipset	MT2718
MediaTek, Inc.	MediaTek chipset	MT2737
MediaTek, Inc.	MediaTek chipset	MT6813
MediaTek, Inc.	MediaTek chipset	MT6815
MediaTek, Inc.	MediaTek chipset	MT6835
MediaTek, Inc.	MediaTek chipset	MT6858
MediaTek, Inc.	MediaTek chipset	MT6878
MediaTek, Inc.	MediaTek chipset	MT6879
MediaTek, Inc.	MediaTek chipset	MT6881
MediaTek, Inc.	MediaTek chipset	MT6886
MediaTek, Inc.	MediaTek chipset	MT6895
MediaTek, Inc.	MediaTek chipset	MT6896
MediaTek, Inc.	MediaTek chipset	MT6897
MediaTek, Inc.	MediaTek chipset	MT6899
MediaTek, Inc.	MediaTek chipset	MT6980
MediaTek, Inc.	MediaTek chipset	MT6982
MediaTek, Inc.	MediaTek chipset	MT6983
MediaTek, Inc.	MediaTek chipset	MT6985
MediaTek, Inc.	MediaTek chipset	MT6986
MediaTek, Inc.	MediaTek chipset	MT6988
MediaTek, Inc.	MediaTek chipset	MT6989
MediaTek, Inc.	MediaTek chipset	MT6990
MediaTek, Inc.	MediaTek chipset	MT6991
MediaTek, Inc.	MediaTek chipset	MT6993
MediaTek, Inc.	MediaTek chipset	MT8186
MediaTek, Inc.	MediaTek chipset	MT8188
MediaTek, Inc.	MediaTek chipset	MT8189
MediaTek, Inc.	MediaTek chipset	MT8195
MediaTek, Inc.	MediaTek chipset	MT8196
MediaTek, Inc.	MediaTek chipset	MT8367
MediaTek, Inc.	MediaTek chipset	MT8391
MediaTek, Inc.	MediaTek chipset	MT8676
MediaTek, Inc.	MediaTek chipset	MT8678

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out of bounds write issue in the Modem component due to a missing bounds check. It allows remote escalation of privilege if a user equipment connects to a malicious base station controlled by an attacker. No user interaction or additional privileges are required for exploitation.

Impact Analysis

An attacker could exploit this to gain elevated privileges on your device by tricking it into connecting to a rogue base station. This could lead to unauthorized access, data theft, or further compromise of your device.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves a potential remote privilege escalation in MediaTek chipsets, which could compromise device security if exploited via a rogue base station.

Mitigation Strategies

Apply the patch identified as MOLY01338165 from MediaTek to address the missing bounds check in Modem. Ensure all MediaTek chipsets are updated to the latest firmware version to prevent remote escalation of privilege via rogue base stations.

Hi! I’m here to help you understand CVE-2026-20585. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...

Out-of-Bounds Write in Modem Firmware

Description

CVSS Scores

EPSS Scores

Meta Information

Affected Vendors & Products

Helpful Resources

Exploitability

Attack-Flow Graph

AI Quick Actions

Chat Assistant

EPSS Chart

Security Radar