{"id":"CVE-2026-20552","kind":"vulnerability","aliases":["CVE-2026-20552"],"related":[],"title":"MediaTek modem driver: out-of-bounds write allows remote denial of service","description":"In ccci, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11523478 (Note: For MT6880, MT6890) / ALPS11297423 (Note: For MT6813, MT6986, MT6982, MT6980D) / AUTO00864897 (Note: For MT2735, MT2737); Issue ID: MSV-10724.","summary":"A missing bounds check in the ccci modem driver in MediaTek chipsets allows an out-of-bounds write. The sources say this can lead to a remote denial of service without extra privileges, and user interaction is needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","iot","mediatek","modem"],"not_affected_if":["other-chipset"],"how_to_check":"- Check whether the device uses a MediaTek modem chipset such as MT6880, MT6890, MT6813, MT6986, MT6982, MT6980D, MT2735 or MT2737.\n- Check the device's security patch level against the vendor's bulletin for patch ALPS11523478, ALPS11297423 or AUTO00864897.","fix":null,"status":"open","published_at":"2026-11-02T03:17:32+00:00","first_seen_at":"2026-11-02T03:31:24+00:00","triaged_at":"2026-11-02T03:33:55+00:00","updated_at":"2026-11-02T03:33:55+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T03:33:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MediaTek modem driver: out-of-bounds write allows remote denial of service","impact":"low","summary":"A missing bounds check in the ccci modem driver in MediaTek chipsets allows an out-of-bounds write. The sources say this can lead to a remote denial of service without extra privileges, and user interaction is needed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["mediatek","android","modem","iot"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote denial of service; the device or modem stops responding.","analyst_note":"Confirm which device models ship the listed MediaTek chipsets and the vendor patch level that includes ALPS11523478 / ALPS11297423 / AUTO00864897.","how_to_check":"- Check whether the device uses a MediaTek modem chipset such as MT6880, MT6890, MT6813, MT6986, MT6982, MT6980D, MT2735 or MT2737.\n- Check the device's security patch level against the vendor's bulletin for patch ALPS11523478, ALPS11297423 or AUTO00864897.","plain_action":"Install the latest security update for your phone or device once the manufacturer releases it.","needs_analyst":true,"not_affected_if":["other-chipset"],"who_is_affected":"Devices built on the listed MediaTek chipsets, where the modem driver is present. Handset and IoT makers ship the fix in their firmware, so a team should check the device vendor's bulletin. Devices on other chipsets are not named in the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4168,"output_tokens":599,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-10724':122C '-2026':15A,18A '-20552':16A,19A 'addit':90C 'allow':9A,37B 'alps11297423':107C 'alps11523478':102C 'android':20B 'auto00864897':114C 'bound':7A,27B,42B,72C,78C 'ccci':31B,65C 'check':28B,79C 'chipset':36B 'could':81C 'cve':14A,17A 'denial':11A,53B,85C 'driver':3A,33B 'due':74C 'execut':91C 'exploit':99C 'extra':57B 'id':101C,120C 'infrastructur':21B 'interact':61B,95C 'iot':22B 'issu':119C 'lead':49B,82C 'mediatek':1A,23B,35B 'miss':26B,77C 'modem':2A,24B,32B 'msv':121C 'mt2735':117C 'mt2737':118C 'mt6813':110C 'mt6880':105C 'mt6890':106C 'mt6980d':113C 'mt6982':112C 'mt6986':111C 'need':63B,93C,97C 'note':103C,108C,115C 'out-of-bound':4A,39B 'patch':100C 'possibl':69C 'privileg':58B,92C 'remot':10A,52B,84C 'say':46B 'servic':13A,55B,87C 'sourc':45B 'user':60B,94C 'without':56B 'write':8A,43B,73C","nicknames":[],"mitigations":[],"who_affected":"Devices built on the listed MediaTek chipsets, where the modem driver is present. Handset and IoT makers ship the fix in their firmware, so a team should check the device vendor's bulletin. Devices on other chipsets are not named in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","iot","mediatek","modem","unknown"],"first_public_at":"2026-11-02T03:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20552","severity":null,"published_at":"2026-11-02T03:17:32+00:00","modified_at":"2026-11-02T03:17:32+00:00","first_seen_at":"2026-11-02T03:31:24+00:00","fetched_at":"2026-11-02T03:31:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}