CVE-2026-20432

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01406170; Issue ID: MSV-4461.
References
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:mediatek:mt8789_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:mediatek:mt8795t_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*

Configuration 24 (hide)

AND
cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*

Configuration 25 (hide)

AND
cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*

Configuration 26 (hide)

AND
cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*

Configuration 27 (hide)

AND
cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*

Configuration 28 (hide)

AND
cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*

Configuration 29 (hide)

AND
cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*

Configuration 30 (hide)

AND
cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*

Configuration 31 (hide)

AND
cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*

Configuration 32 (hide)

AND
cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*

Configuration 33 (hide)

AND
cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*

Configuration 34 (hide)

AND
cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*

Configuration 35 (hide)

AND
cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*

Configuration 36 (hide)

AND
cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*

Configuration 37 (hide)

AND
cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*

Configuration 38 (hide)

AND
cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*

Configuration 39 (hide)

AND
cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*

Configuration 40 (hide)

AND
cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*

Configuration 41 (hide)

AND
cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*

Configuration 42 (hide)

AND
cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*

Configuration 43 (hide)

AND
cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*

Configuration 44 (hide)

AND
cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*

Configuration 45 (hide)

AND
cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*

Configuration 46 (hide)

AND
cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*

Configuration 47 (hide)

AND
cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*

Configuration 48 (hide)

AND
cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*

Configuration 49 (hide)

AND
cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*

Configuration 50 (hide)

AND
cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*

Configuration 51 (hide)

AND
cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*

Configuration 52 (hide)

AND
cpe:2.3:o:mediatek:mt8673_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*

Configuration 53 (hide)

AND
cpe:2.3:o:mediatek:mt8675_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*

Configuration 54 (hide)

AND
cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*

Configuration 55 (hide)

AND
cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*

Configuration 56 (hide)

AND
cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*

Configuration 57 (hide)

AND
cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*

Configuration 58 (hide)

AND
cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-07 04:17

Updated : 2026-07-24 22:10


NVD link : CVE-2026-20432

Mitre link : CVE-2026-20432

CVE.ORG link : CVE-2026-20432


JSON object : View

Products Affected

mediatek

  • mt6896
  • mt6783_firmware
  • mt6833
  • mt6789_firmware
  • mt6980_firmware
  • mt8797_firmware
  • mt6779_firmware
  • mt6878
  • mt6889_firmware
  • mt6990_firmware
  • mt6833_firmware
  • mt6985_firmware
  • mt6873
  • mt8771_firmware
  • mt6875
  • mt8668_firmware
  • mt6885_firmware
  • mt6991
  • mt8675
  • mt6853
  • mt6880
  • mt6886_firmware
  • mt6897
  • mt8781_firmware
  • mt6878_firmware
  • mt2735
  • mt8755_firmware
  • mt2737
  • mt6885
  • mt6781
  • mt6896_firmware
  • mt6873_firmware
  • mt8798_firmware
  • mt6889
  • mt6990
  • mt8791_firmware
  • mt8676
  • mt6877
  • mt8791
  • mt8791t_firmware
  • mt6883_firmware
  • mt8863
  • mt8675_firmware
  • mt8676_firmware
  • mt6993
  • mt8795t
  • mt6879
  • mt6895_firmware
  • mt6897_firmware
  • mt6983_firmware
  • mt8863_firmware
  • mt8798
  • mt6890_firmware
  • mt6891
  • mt8668
  • mt6883
  • mt8678_firmware
  • mt6813
  • mt8883
  • mt6983
  • mt8789_firmware
  • mt6855_firmware
  • mt6899
  • mt8791t
  • mt6879_firmware
  • mt8775
  • mt8793
  • mt8793_firmware
  • mt8678
  • mt6895
  • mt6877_firmware
  • mt6893
  • mt8755
  • mt8775_firmware
  • mt6993_firmware
  • mt6835_firmware
  • mt6783
  • mt6991_firmware
  • mt6875_firmware
  • mt6813_firmware
  • mt6891_firmware
  • mt6835
  • mt2735_firmware
  • mt6989
  • mt6785_firmware
  • mt6855
  • mt6853_firmware
  • mt8789
  • mt6789
  • mt8673_firmware
  • mt6980
  • mt8797
  • mt6785
  • mt6989_firmware
  • mt6886
  • mt8893
  • mt8873_firmware
  • mt6815_firmware
  • mt8883_firmware
  • mt2737_firmware
  • mt8673
  • mt6890
  • mt6779
  • mt8795t_firmware
  • mt8781
  • mt8792
  • mt6985
  • mt8771
  • mt6899_firmware
  • mt6781_firmware
  • mt8873
  • mt6815
  • mt6880_firmware
  • mt8893_firmware
  • mt6893_firmware
  • mt8792_firmware
CWE
CWE-787

Out-of-bounds Write