Loading vulnerability…
Remote Privilege Escalation in MediaTek Modem
CVE-2026-20546 is a critical out-of-bounds write vulnerability in MediaTek modem components caused by an incorrect bounds check. An attacker controlling a rogue base station may exploit the flaw to remotely escalate privileges when a vulnerable user equipment (UE) device connects to that station. Exploitation requires neither additional execution privileges nor user interaction. The specific vulnerable function and affected chipset or firmware versions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause memory corruption and remote privilege escalation on an affected device. The resulting privilege level and whether compromise extends beyond the modem subsystem are not specified.
Patch, then assume compromise.
Install the device manufacturer's modem firmware update incorporating MediaTek patch MOLY01876654 / MOLY01774038 for issue MSV-9803. For affected Android devices, apply the applicable manufacturer update providing security patch level 2026-11-05 or later and verify device-specific coverage. Exact fixed firmware versions are not specified.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.