CVE-2026-20479

Analyzed Analyzed - Analysis Complete

Out of Bounds Read in Modem

Publication date: 2026-08-03

Last updated on: 2026-08-19

Assigner: MediaTek, Inc.

Description

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00741071; Issue ID: MSV-7620.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-19

Generated

2026-08-23

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2026-20479

EUVD

EUVD-2026-52068

Affected Vendors & Products

Vendor	Product	Version / Range
mediatek	mt2735_firmware	*
mediatek	mt6833_firmware	*
mediatek	mt6853_firmware	*
mediatek	mt6855_firmware	*
mediatek	mt6873_firmware	*
mediatek	mt6875_firmware	*
mediatek	mt6877_firmware	*
mediatek	mt6880_firmware	*
mediatek	mt6883_firmware	*
mediatek	mt6885_firmware	*
mediatek	mt6889_firmware	*
mediatek	mt6890_firmware	*
mediatek	mt6891_firmware	*
mediatek	mt6893_firmware	*
mediatek	mt8675_firmware	*
mediatek	mt8771_firmware	*
mediatek	mt8791_firmware	*
mediatek	mt8791t_firmware	*
mediatek	mt8797_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Modem component where a missing bounds check can lead to an out of bounds read. This may cause a remote denial of service if a user equipment connects to a malicious base station controlled by an attacker. No additional privileges are required for exploitation, and user interaction is not needed.

Detection Guidance

This vulnerability cannot be directly detected with standard commands as it involves a missing bounds check in Modem leading to potential out-of-bounds reads. Detection would require vendor-specific tools or patches from MediaTek (Patch ID: MOLY00741071).

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial of service on your device by making it connect to a rogue base station. This could disrupt normal device functionality without requiring any action from you.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with GDPR, HIPAA, or other standards. The vulnerability involves a potential out-of-bounds read in a modem, leading to remote denial of service under specific conditions. No evidence suggests it affects data protection or privacy compliance.

Mitigation Strategies

Apply the patch identified as MOLY00741071 to address the missing bounds check in the Modem component.

Hi! I’m here to help you understand CVE-2026-20479. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70