Loading vulnerability…
Remote Privilege Escalation via Integer Overflow in MediaTek Modem
CVE-2026-20548 is a critical integer overflow vulnerability in MediaTek modem software that can cause an out-of-bounds write. An attacker controlling a rogue base station may exploit the flaw when user equipment connects to that station, potentially achieving remote privilege escalation. Exploitation requires neither additional execution privileges nor user interaction. The affected function and exact vulnerable software versions are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt memory through an out-of-bounds write and potentially elevate an attacker's privileges on affected user equipment. The resulting privilege level and whether access extends beyond the modem are not specified.
Patch, then assume compromise.
Install the applicable device-manufacturer firmware or security update incorporating MediaTek patches MOLY01872867 / MOLY01774038 for issue MSV-9801. Fixed modem software versions and device-specific firmware builds are not specified; verify update applicability with the device manufacturer.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.