CVE-2026-20538: Modem Out of Bounds Read DOS Vulnerability

CVE-2026-20538 Overview

CVE-2026-20538 is an out-of-bounds read vulnerability in the MediaTek Modem component. The flaw stems from a missing permission check and can be triggered when a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation requires no user interaction and no additional execution privileges. Successful exploitation leads to a remote denial of service (DoS) condition on the affected modem.

MediaTek tracks the fix under Patch ID MOLY01774038 and Issue ID MSV-8914. The vulnerability is classified as [CWE-126] Buffer Over-read. The attack vector is adjacent network, limiting exploitation to attackers with radio proximity to the target device.

Critical Impact
An attacker operating a rogue base station can remotely crash the modem of nearby MediaTek-powered devices, disrupting cellular connectivity without user interaction.

Affected Products

MediaTek Modem (components listed in the October 2026 Product Security Bulletin)
Devices integrating affected MediaTek baseband chipsets
Smartphones, tablets, and IoT devices using the vulnerable MOLY modem firmware

Discovery Timeline

2026-10-05 - CVE-2026-20538 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-20538

Vulnerability Analysis

The vulnerability resides in the MediaTek Modem firmware, which handles baseband communication between the device and cellular network infrastructure. A missing permission check allows the modem to process attacker-supplied data that triggers a read beyond the bounds of an allocated buffer. The out-of-bounds read corrupts internal modem state and causes the baseband to crash, interrupting cellular connectivity.

The root cause is categorized under [CWE-126] Buffer Over-read, where the modem reads memory past the intended boundary of a buffer. Because the missing check applies before validation of message origin, a rogue base station can send malformed signaling messages that reach the vulnerable code path.

Root Cause

The defect is a missing permission check in a modem code path that processes signaling data from the serving cell. Without the check, the firmware accepts attacker-crafted input and dereferences memory beyond the buffer boundary. This produces an out-of-bounds read that terminates modem operation.

Attack Vector

Exploitation requires the attacker to operate a rogue base station within radio range of the target device. Once the UE associates with the attacker-controlled cell, the attacker transmits a crafted message that reaches the vulnerable modem handler. No user interaction, authentication, or elevated privileges are required. The attack results in loss of cellular service until the modem recovers or the device is restarted.

Technical details are described in the MediaTek Product Security Bulletin.

Detection Methods for CVE-2026-20538

Indicators of Compromise

Unexpected modem crashes, resets, or loss of cellular radio service on MediaTek-based devices
Device logs showing baseband or RIL (Radio Interface Layer) errors coinciding with cell reselection events
Repeated attachment to unknown or anomalous cell identifiers (unexpected PLMN, TAC, or CGI values)

Detection Strategies

Monitor mobile device management (MDM) telemetry for abnormal rates of modem crashes or connectivity loss across fleets of MediaTek-powered devices.
Correlate cellular connectivity loss with geolocation data to identify areas where rogue base station activity may be present.
Review baseband and kernel logs on affected devices for repeated out-of-bounds or null-pointer exceptions originating in modem handlers.

Monitoring Recommendations

Deploy mobile threat defense tooling that flags attachment to suspicious or non-operator cells.
Track device patch level against the MediaTek October 2026 bulletin and verify Patch ID MOLY01774038 is applied.
Alert on clusters of simultaneous loss-of-service events in physically proximate devices, which may indicate a rogue cell attack in progress.

How to Mitigate CVE-2026-20538

Immediate Actions Required

Apply the vendor patch distributed by device OEMs that include MediaTek Patch ID MOLY01774038.
Inventory devices by chipset and firmware version to identify unpatched MediaTek-based endpoints in the environment.
For high-risk users, restrict operation in untrusted radio environments until patches are deployed.

Patch Information

MediaTek has released a fix referenced as Patch ID MOLY01774038 and Issue ID MSV-8914. The patch is distributed to device manufacturers for integration into their firmware update cycles. Refer to the MediaTek Product Security Bulletin for October 2026 for the complete list of affected chipsets and remediated components. End users should install OS and firmware updates provided by their device vendor as they become available.

Workarounds

No vendor-supplied workaround is documented; applying the firmware patch is the authoritative remediation.
Where feasible, enable 5G-only or operator-restricted modes that reduce exposure to downgrade-based rogue cell attacks.
Disable cellular connectivity in high-risk environments until patched firmware is available for the device.

bash

# Verify Android device patch level after OEM update
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.vendor.mediatek.version.release