Loading vulnerability…
Remote Privilege Escalation via Out-of-Bounds Write in MediaTek Modem
CVE-2026-20520 is an out-of-bounds write vulnerability in MediaTek modem components caused by a missing bounds check. An attacker controlling a rogue base station may trigger the vulnerability when user equipment connects to that station, potentially causing remote privilege escalation. Exploitation requires neither additional execution privileges nor user interaction. The specific vulnerable function and affected firmware versions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could remotely elevate privileges on affected user equipment through memory corruption in the modem component. The resulting privilege level and whether compromise extends beyond the modem are not specified.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary mitigation or workaround is documented. Vendor security updates are the recommended corrective action.
Patch, then assume compromise.
Apply the device manufacturer's modem firmware update incorporating MediaTek patch MOLY01778988, associated with issue MSV-8897. Install applicable November 2026 device security updates, targeting Android security patch level 2026-11-05 where available, and verify device-specific coverage with the manufacturer. Exact fixed firmware and build versions are not specified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.