CVE-2026-20548 - Vulnerability Details - OpenCVE

ReportizFlow

In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mediatek	Mediatek Chipset
Mediatek, Inc.	Mediatek Chipset

No data.

No data.

References

Link	Providers
https://www.mediatek.com/product-security-bulletin/November-2026

History

Mon, 02 Nov 2026 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mediatek Mediatek mediatek Chipset Mediatek, Inc. Mediatek, Inc. mediatek Chipset
Vendors & Products		Mediatek Mediatek mediatek Chipset Mediatek, Inc. Mediatek, Inc. mediatek Chipset

Mon, 02 Nov 2026 03:45:00 +0000

Type	Values Removed	Values Added
Title		Modem Integer Overflow Allows Remote Privilege Escalation in MediaTek Chipset

Mon, 02 Nov 2026 02:45:00 +0000

Type	Values Removed	Values Added
Description		In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801.
Weaknesses		CWE-787
References		https://www.mediatek.com/product-security-bulletin/November-2026

MITRE

Status: PUBLISHED

Assigner: MediaTek

Published: 2026-11-02T02:33:05.476Z

Updated: 2026-11-02T02:33:05.476Z

Reserved: 2025-11-03T01:30:59.041Z

Link: CVE-2026-20548

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-02T03:17:31.650

Modified: 2026-11-02T03:17:31.650

Link: CVE-2026-20548

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20548", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2025-11-03T01:30:59.041Z", "datePublished": "2026-11-02T02:33:05.476Z", "dateUpdated": "2026-11-02T02:33:05.476Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-11-02T02:33:05.476Z"}, "descriptions": [{"lang": "en", "value": "In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "defaultStatus": "unaffected", "versions": [{"version": "MT2716", "status": "affected"}, {"version": "MT2735", "status": "affected"}, {"version": "MT2737", "status": "affected"}, {"version": "MT6739", "status": "affected"}, {"version": "MT6761", "status": "affected"}, {"version": "MT6762", "status": "affected"}, {"version": "MT6763", "status": "affected"}, {"version": "MT6765", "status": "affected"}, {"version": "MT6767", "status": "affected"}, {"version": "MT6768", "status": "affected"}, {"version": "MT6769", "status": "affected"}, {"version": "MT6771", "status": "affected"}, {"version": "MT6779", "status": "affected"}, {"version": "MT6781", "status": "affected"}, {"version": "MT6783", "status": "affected"}, {"version": "MT6785", "status": "affected"}, {"version": "MT6789", "status": "affected"}, {"version": "MT6813", "status": "affected"}, {"version": "MT6815", "status": "affected"}, {"version": "MT6833", "status": "affected"}, {"version": "MT6835", "status": "affected"}, {"version": "MT6853", "status": "affected"}, {"version": "MT6855", "status": "affected"}, {"version": "MT6858", "status": "affected"}, {"version": "MT6873", "status": "affected"}, {"version": "MT6875", "status": "affected"}, {"version": "MT6877", "status": "affected"}, {"version": "MT6878", "status": "affected"}, {"version": "MT6879", "status": "affected"}, {"version": "MT6880", "status": "affected"}, {"version": "MT6881", "status": "affected"}, {"version": "MT6883", "status": "affected"}, {"version": "MT6885", "status": "affected"}, {"version": "MT6886", "status": "affected"}, {"version": "MT6889", "status": "affected"}, {"version": "MT6890", "status": "affected"}, {"version": "MT6891", "status": "affected"}, {"version": "MT6893", "status": "affected"}, {"version": "MT6895", "status": "affected"}, {"version": "MT6896", "status": "affected"}, {"version": "MT6897", "status": "affected"}, {"version": "MT6899", "status": "affected"}, {"version": "MT6980", "status": "affected"}, {"version": "MT6982", "status": "affected"}, {"version": "MT6983", "status": "affected"}, {"version": "MT6985", "status": "affected"}, {"version": "MT6986", "status": "affected"}, {"version": "MT6988", "status": "affected"}, {"version": "MT6989", "status": "affected"}, {"version": "MT6990", "status": "affected"}, {"version": "MT6991", "status": "affected"}, {"version": "MT6993", "status": "affected"}, {"version": "MT8668", "status": "affected"}, {"version": "MT8676", "status": "affected"}, {"version": "MT8678", "status": "affected"}, {"version": "MT8755", "status": "affected"}, {"version": "MT8765", "status": "affected"}, {"version": "MT8766", "status": "affected"}, {"version": "MT8766R", "status": "affected"}, {"version": "MT8768", "status": "affected"}, {"version": "MT8771", "status": "affected"}, {"version": "MT8775", "status": "affected"}, {"version": "MT8781", "status": "affected"}, {"version": "MT8786", "status": "affected"}, {"version": "MT8788E", "status": "affected"}, {"version": "MT8791", "status": "affected"}, {"version": "MT8791T", "status": "affected"}, {"version": "MT8792", "status": "affected"}, {"version": "MT8793", "status": "affected"}, {"version": "MT8796", "status": "affected"}, {"version": "MT8797", "status": "affected"}, {"version": "MT8798", "status": "affected"}, {"version": "MT8863", "status": "affected"}, {"version": "MT8873", "status": "affected"}, {"version": "MT8875", "status": "affected"}, {"version": "MT8883", "status": "affected"}, {"version": "MT8893", "status": "affected"}]}], "references": [{"url": "https://www.mediatek.com/product-security-bulletin/November-2026"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MediaTek chipset", "vendor": "MediaTek, Inc.", "versions": [{"status": "affected", "version": "MT2716"}, {"status": "affected", "version": "MT2735"}, {"status": "affected", "version": "MT2737"}, {"status": "affected", "version": "MT6739"}, {"status": "affected", "version": "MT6761"}, {"status": "affected", "version": "MT6762"}, {"status": "affected", "version": "MT6763"}, {"status": "affected", "version": "MT6765"}, {"status": "affected", "version": "MT6767"}, {"status": "affected", "version": "MT6768"}, {"status": "affected", "version": "MT6769"}, {"status": "affected", "version": "MT6771"}, {"status": "affected", "version": "MT6779"}, {"status": "affected", "version": "MT6781"}, {"status": "affected", "version": "MT6783"}, {"status": "affected", "version": "MT6785"}, {"status": "affected", "version": "MT6789"}, {"status": "affected", "version": "MT6813"}, {"status": "affected", "version": "MT6815"}, {"status": "affected", "version": "MT6833"}, {"status": "affected", "version": "MT6835"}, {"status": "affected", "version": "MT6853"}, {"status": "affected", "version": "MT6855"}, {"status": "affected", "version": "MT6858"}, {"status": "affected", "version": "MT6873"}, {"status": "affected", "version": "MT6875"}, {"status": "affected", "version": "MT6877"}, {"status": "affected", "version": "MT6878"}, {"status": "affected", "version": "MT6879"}, {"status": "affected", "version": "MT6880"}, {"status": "affected", "version": "MT6881"}, {"status": "affected", "version": "MT6883"}, {"status": "affected", "version": "MT6885"}, {"status": "affected", "version": "MT6886"}, {"status": "affected", "version": "MT6889"}, {"status": "affected", "version": "MT6890"}, {"status": "affected", "version": "MT6891"}, {"status": "affected", "version": "MT6893"}, {"status": "affected", "version": "MT6895"}, {"status": "affected", "version": "MT6896"}, {"status": "affected", "version": "MT6897"}, {"status": "affected", "version": "MT6899"}, {"status": "affected", "version": "MT6980"}, {"status": "affected", "version": "MT6982"}, {"status": "affected", "version": "MT6983"}, {"status": "affected", "version": "MT6985"}, {"status": "affected", "version": "MT6986"}, {"status": "affected", "version": "MT6988"}, {"status": "affected", "version": "MT6989"}, {"status": "affected", "version": "MT6990"}, {"status": "affected", "version": "MT6991"}, {"status": "affected", "version": "MT6993"}, {"status": "affected", "version": "MT8668"}, {"status": "affected", "version": "MT8676"}, {"status": "affected", "version": "MT8678"}, {"status": "affected", "version": "MT8755"}, {"status": "affected", "version": "MT8765"}, {"status": "affected", "version": "MT8766"}, {"status": "affected", "version": "MT8766R"}, {"status": "affected", "version": "MT8768"}, {"status": "affected", "version": "MT8771"}, {"status": "affected", "version": "MT8775"}, {"status": "affected", "version": "MT8781"}, {"status": "affected", "version": "MT8786"}, {"status": "affected", "version": "MT8788E"}, {"status": "affected", "version": "MT8791"}, {"status": "affected", "version": "MT8791T"}, {"status": "affected", "version": "MT8792"}, {"status": "affected", "version": "MT8793"}, {"status": "affected", "version": "MT8796"}, {"status": "affected", "version": "MT8797"}, {"status": "affected", "version": "MT8798"}, {"status": "affected", "version": "MT8863"}, {"status": "affected", "version": "MT8873"}, {"status": "affected", "version": "MT8875"}, {"status": "affected", "version": "MT8883"}, {"status": "affected", "version": "MT8893"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801."}], "id": "CVE-2026-20548", "lastModified": "2026-11-02T03:17:31.650", "metrics": {}, "published": "2026-11-02T03:17:31.650", "references": [{"source": "[email protected]", "url": "https://www.mediatek.com/product-security-bulletin/November-2026"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Primary"}]}