Loading vulnerability…
Remote Privilege Escalation in MediaTek Modem
CVE-2026-20519 is an out-of-bounds write vulnerability in MediaTek modem components caused by a missing bounds check. An attacker controlling a rogue base station can potentially exploit the vulnerability when a user equipment (UE) device connects to that station, resulting in remote privilege escalation. Exploitation requires no additional execution privileges or user interaction. The specific vulnerable function and affected modem versions are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could allow remote privilege escalation on an affected UE device connected to an attacker-controlled base station. The resulting privilege level and scope of access beyond the modem component are not specified.
Patch, then assume compromise.
Install the device manufacturer's modem firmware or security update incorporating MediaTek patch MOLY01778993, associated with issue MSV-8898. Apply Android security patch level 2026-11-05 where available and confirm device-specific coverage with the manufacturer. Exact fixed modem firmware versions are not specified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.