In Modem, there is a possible out of bounds write due to a missing bounds check.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: The checked facts state no workaround and no fix. No specific mitigation for the Modem component is recorded, so none can be recommended from these sources.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 14/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The vulnerability affects the modem firmware in certain mobile devices and chipsets. An attacker operating a rogue base station could exploit it to gain elevated privileges on a connected device without user interaction.
Read the original description
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.
What to do
Workaround: The checked facts state no workaround and no fix. No specific mitigation for the Modem component is recorded, so none can be recommended from these sources.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- MediaTek, Inc. MediaTek chipset
MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, and 47 more
Evidence 1
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-20545
What does this mean?
The bug is an out-of-bounds write in the Modem component, caused by a missing bounds check. The advisory does not state what the resulting impact is.Source: mediatek.com
Am I affected, and how do I check?
The advisory lists MediaTek chipsets including MT2716, MT2735, MT2737, MT6739, MT6761, and MT6762, plus others in the Modem subcomponent list. No version ranges are given, so a reader can check by finding the chipset model in the device's specifications and comparing it against that list.Source: mediatek.com
What should I do about it?
The checked facts record no fixed version or upgrade target, so there is no specific update to install from these sources. Check the device maker's update channel for any modem or firmware update.Source: mediatek.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts state no workaround and no fix. No specific mitigation for the Modem component is recorded, so none can be recommended from these sources.Source: mediatek.com