CVE-2026-20504: Mediatek Mt2735 Firmware DOS Vulnerability

CVE-2026-20504 Overview

CVE-2026-20504 is a denial-of-service vulnerability in the MediaTek modem firmware caused by a missing bounds check. An attacker operating a rogue base station can trigger a system crash on a User Equipment (UE) device that connects to it. Exploitation requires no user interaction and no additional execution privileges. The flaw is classified under [CWE-617] (Reachable Assertion) and impacts a broad set of MediaTek chipsets used across smartphones, tablets, and connected devices.

MediaTek addressed the issue in Patch ID MOLY00755024, tracked internally as Issue ID MSV-7865.

Critical Impact
A remote attacker within radio range can crash the modem of a targeted MediaTek-powered device by forcing it to connect to a rogue base station, disrupting cellular connectivity.

Affected Products

MediaTek MT2735, MT6833, MT6853, MT6855 firmware
MediaTek MT6873, MT6875, MT6877, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893 firmware
MediaTek MT8675, MT8771, MT8791, MT8791T, MT8797 firmware

Discovery Timeline

2026-09-07 - CVE-2026-20504 published to the National Vulnerability Database
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-20504

Vulnerability Analysis

The flaw resides in the baseband modem stack of affected MediaTek chipsets. A specific message processed by the modem lacks a bounds check on attacker-controlled input, allowing malformed radio-layer data to reach a code path that terminates modem execution. The result is a denial of service against the modem subsystem, which disrupts voice, SMS, and data connectivity until the device or modem is restarted.

Because the vulnerable code path is reachable during pre-authentication signaling, a UE can be crashed as soon as it attaches to a malicious base station. The impact is confined to availability; confidentiality and integrity of user data are not affected.

Root Cause

The root cause is a missing input length or range validation in the modem firmware. When the modem parses a specific network-originated message, it fails to verify that a field falls within expected boundaries. The unchecked value drives execution into an unreachable or assertion state, producing a system crash consistent with [CWE-617].

Attack Vector

Exploitation requires proximity, not authentication. The attacker stands up a rogue 4G or 5G base station broadcasting on frequencies the target UE will attempt to camp on. Once the target device performs cell selection and initiates signaling with the rogue cell, the attacker sends the malformed message that trips the missing bounds check. No interaction from the device user is required, and no valid SIM credentials are needed on the attacker side beyond what is necessary to accept the UE attachment.

MediaTek has not published proof-of-concept code, and no public exploit is available. See the MediaTek Security Bulletin - September 2026 for vendor details.

Detection Methods for CVE-2026-20504

Indicators of Compromise

Unexpected modem restarts or baseband crash logs (ramdump, modem_crash, SSR) on MediaTek-powered devices without prior instability history.
Repeated loss of cellular service in specific geographic areas that correlates with the presence of unauthorized base stations.
Device logs showing failed attach or NAS/RRC signaling anomalies immediately preceding modem reset events.

Detection Strategies

Aggregate mobile device management (MDM) telemetry to identify fleets of MediaTek devices experiencing anomalous modem crash rates.
Use IMSI-catcher and rogue base station detection tools to identify hostile cells operating near sensitive facilities.
Correlate modem crash timestamps with RF survey data to attribute outages to specific attacker infrastructure.

Monitoring Recommendations

Monitor vendor bulletins from MediaTek and downstream device manufacturers for firmware patch availability tied to Patch ID MOLY00755024.
Track cellular signaling anomalies in high-risk environments using dedicated cellular monitoring appliances.
Enroll mobile devices in an endpoint management platform to collect crash and connectivity telemetry at scale.

How to Mitigate CVE-2026-20504

Immediate Actions Required

Inventory devices that use the affected MediaTek chipsets listed in the September 2026 MediaTek Security Bulletin.
Apply firmware updates delivered by device OEMs as soon as they incorporate Patch ID MOLY00755024.
Advise high-risk users to disable 2G fallback and, where feasible, restrict cellular operation to trusted networks.

Patch Information

MediaTek released the fix in Patch ID MOLY00755024, referenced under Issue ID MSV-7865. The patch is distributed to device manufacturers, who ship it as part of monthly baseband and Android security updates. Consult the MediaTek Security Bulletin - September 2026 for the authoritative list of affected chipsets and remediation status.

Workarounds

Enable airplane mode when operating in untrusted RF environments where rogue base stations may be present.
Prefer Wi-Fi calling and Wi-Fi data on unpatched devices in high-risk locations to reduce exposure to malicious cells.
Reboot affected devices to restore modem functionality after a crash and report recurring incidents to security teams for RF investigation.

bash

# Configuration example: check MediaTek device firmware build via adb
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.hardware
adb shell getprop gsm.version.baseband