CVE-2026-20504
Received Received - Intake

System Crash Due to Missing Bounds Check in Modem

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: MediaTek, Inc.

Description
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00755024; Issue ID: MSV-7865.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-20504
EUVD
EUVD-2026-72197

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mediatek modem *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Mediatek modem allows a remote denial of service attack. It occurs due to a missing bounds check, which could cause the system to crash. Exploitation requires a user equipment (UE) to connect to a malicious base station controlled by the attacker. No additional privileges or user interaction are needed for exploitation.

Impact Analysis

If exploited, this vulnerability could cause your device to crash or become unresponsive, leading to a denial of service. This means you might lose access to network services or the device may need a restart. The attack requires proximity to a rogue base station.

Compliance Impact

The vulnerability could lead to remote denial of service, potentially disrupting systems handling sensitive data. This may impact compliance with standards like GDPR or HIPAA by compromising availability of personal or health information systems.

Mitigation Strategies

Apply the patch identified as MOLY00755024 to address the missing bounds check in the Modem component. Ensure your system is updated to the latest firmware version provided by Mediatek.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20504. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart