CVE-2026-20500

Received Received - Intake

Modem System Crash via Improper Input Validation

Publication date: 2026-09-07

Last updated on: 2026-09-09

Assigner: MediaTek, Inc.

Description

In Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01810811; Issue ID: MSV-9232.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-09

Generated

2026-09-27

AI Q&A

2026-09-07

EPSS Evaluated

2026-09-26

NVD

CVE-2026-20500

EUVD

EUVD-2026-72193

Affected Vendors & Products

Vendor	Product	Version / Range
mediatek	mt2716_firmware	*
mediatek	mt6835_firmware	*
mediatek	mt6858_firmware	*
mediatek	mt6878_firmware	*
mediatek	mt6881_firmware	*
mediatek	mt6897_firmware	*
mediatek	mt6899_firmware	*
mediatek	mt6982vb_firmware	*
mediatek	mt6986_firmware	*
mediatek	mt6988_firmware	*
mediatek	mt6991_firmware	*
mediatek	mt6993_firmware	*
mediatek	mt8668_firmware	*
mediatek	mt8676_firmware	*
mediatek	mt8678_firmware	*
mediatek	mt8755_firmware	*
mediatek	mt8775_firmware	*
mediatek	mt8792_firmware	*
mediatek	mt8793_firmware	*
mediatek	mt8863_firmware	*
mediatek	mt8873_firmware	*
mediatek	mt8883_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability in the Modem component allows a local denial of service due to improper input validation. It requires user execution privileges and user interaction to exploit. The issue could cause the system to crash.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. I don't know

Impact Analysis

An attacker with user access could trigger a system crash, leading to a denial of service. This disrupts normal device operation until a restart.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves a local denial of service requiring user execution privileges and interaction, but no data exposure or privacy implications are mentioned.

Mitigation Strategies

Apply the provided patch ID MOLY01810811 to address the improper input validation issue in the Modem component.

Hi! I’m here to help you understand CVE-2026-20500. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70