CVE-2026-20539: Modem Out of Bounds Read DOS Vulnerability

CVE-2026-20539 Overview

CVE-2026-20539 is an out-of-bounds read vulnerability in the MediaTek Modem component. The flaw stems from a missing bounds check during message processing [CWE-126]. An attacker operating a rogue base station can trigger the condition against a connected User Equipment (UE), causing a remote denial of service. Exploitation requires no user interaction and no additional execution privileges. MediaTek tracks the fix under Patch ID MOLY01774038 and Issue ID MSV-8913.

Critical Impact
An adjacent-network attacker running a rogue base station can crash the modem of any UE that attaches, disrupting cellular connectivity without user interaction.

Affected Products

MediaTek Modem firmware referenced in the October 2026 Product Security Bulletin
User Equipment (UE) devices integrating affected MediaTek modem baseband chipsets
OEM smartphones and connected devices that have not applied Patch ID MOLY01774038

Discovery Timeline

2026-10-05 - CVE-2026-20539 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-20539

Vulnerability Analysis

The vulnerability resides in the MediaTek Modem baseband code path that parses signaling messages from a serving base station. A missing bounds check allows the parser to read memory beyond the end of an intended buffer [CWE-126]. The resulting out-of-bounds read corrupts program state or returns invalid data, causing the modem to terminate. Loss of modem availability translates to loss of cellular voice and data connectivity on the affected UE.

The attack surface sits at the radio interface, so the attacker must be within radio range and operate a rogue base station the UE will attach to. Attachment to a rogue cell is a well-documented adjacent-network technique using commodity software-defined radio hardware. Once the UE connects, the attacker sends crafted signaling that triggers the unchecked read.

Root Cause

The root cause is a missing input length validation in a modem message handler. The handler reads a length or offset field from attacker-controlled input and dereferences it without verifying that the referenced data lies within the allocated buffer. This matches the Buffer Over-read classification in CWE-126.

Attack Vector

The attack vector is Adjacent Network. The adversary stands up a rogue base station on a frequency and public land mobile network (PLMN) the target UE will attach to. After attachment, the base station transmits a malformed signaling message that the modem parses without bounds checking. No application interaction on the device is required. No verified exploit code is publicly available at this time. For technical specifics, consult the MediaTek Product Security Bulletin – October 2026.

Detection Methods for CVE-2026-20539

Indicators of Compromise

Unexpected modem resets, radio stack crashes, or repeated loss of cellular service on affected devices
Device logs showing baseband restarts correlated with attachment to unknown or unexpected cell IDs
Presence of unknown base stations broadcasting familiar PLMN identifiers in the operating environment

Detection Strategies

Monitor mobile device management (MDM) telemetry for crash reports and modem reboot counters on MediaTek-based fleets
Perform periodic RF surveys in sensitive facilities to identify rogue or unauthorized cellular transmitters
Correlate help-desk reports of sudden connectivity loss with physical location clusters that may indicate a localized rogue cell

Monitoring Recommendations

Track OEM and carrier firmware advisories to confirm when Patch ID MOLY01774038 ships to each device model
Alert on repeated baseband crash signatures surfaced through MDM or endpoint telemetry
For high-risk users, enable logging of serving cell identifiers to detect unexpected cell attachments

How to Mitigate CVE-2026-20539

Immediate Actions Required

Inventory devices using MediaTek modem chipsets and identify firmware versions in the fleet
Apply vendor firmware updates incorporating Patch ID MOLY01774038 as soon as the OEM makes them available
Instruct high-risk users to disable 2G fallback and prefer modern radio access technologies where supported

Patch Information

MediaTek has published the fix under Patch ID MOLY01774038 (Issue ID MSV-8913) in the MediaTek Product Security Bulletin – October 2026. Patch delivery depends on device OEMs and carriers integrating the modem firmware update into their security releases.

Workarounds

Keep devices out of radio range of untrusted or unverified cellular transmitters when operating in sensitive locations
Use airplane mode or carrier-provided private networks in environments where rogue base station activity is suspected
Prioritize patch deployment for executive, field, and travel-use devices that are more likely to encounter adversary-controlled radio environments

bash

# Example: query a managed Android device for baseband/firmware version
adb shell getprop gsm.version.baseband