{"id":"CVE-2026-20556","kind":"vulnerability","aliases":["CVE-2026-20556"],"related":[],"title":"Modem: out-of-bounds write lets a rogue base station escalate privilege","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876662; Issue ID: MSV-9833.","summary":"A missing bounds check in the modem firmware allows an out-of-bounds write. A phone or device that connects to an attacker-controlled rogue base station can be pushed to escalate privilege remotely, with no user interaction.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MediaTek modem chipsets","fixed":[],"affected":"MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","cellular","infrastructure","mediatek","mobile-devices","modem"],"not_affected_if":["no-cellular-modem","non-mediatek-chipset"],"how_to_check":"Find your device's chipset (Settings > About phone, or the maker's spec sheet) and compare with the chipsets in the MediaTek November 2026 bulletin. Then check that the device maker's security update dated 2026-11-01 or later is installed; MediaTek's bulletin does not name the patch level, so ask the maker which build carries MOLY01876662.","fix":null,"status":"open","published_at":"2026-11-02T03:17:32+00:00","first_seen_at":"2026-11-02T03:31:24+00:00","triaged_at":"2026-11-02T03:32:36+00:00","updated_at":"2026-11-02T03:33:47+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-02T03:32:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Modem: out-of-bounds write lets a rogue base station escalate privilege","impact":"high","summary":"A missing bounds check in the modem firmware allows an out-of-bounds write. A phone or device that connects to an attacker-controlled rogue base station can be pushed to escalate privilege remotely, with no user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["modem","cellular","mobile-devices"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker escalates privilege on the device after rogue base station connection","analyst_note":"Check the NVD entry and the vendor bulletin for affected chipsets, device models and the patch level that carries MOLY01876662.","how_to_check":"unknown","plain_action":"Install the latest phone and modem software update from your device maker once it is released.","needs_analyst":true,"not_affected_if":["no-cellular-modem"],"who_is_affected":"Devices with the affected modem firmware that connect to cellular networks are exposed when a rogue base station is nearby. Servers and fixed infrastructure without a cellular modem are not affected. The sources do not name the affected device models or versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":4122,"output_tokens":471,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor bulletin for affected chipsets, device models and the patch level that carries MOLY01876662.","search":"'-2026':15A,18A '-20556':16A,19A '-9833':128C 'addit':111C 'allow':39B 'android':23B 'attack':55B,108C 'attacker-control':54B 'base':10A,58B,103C 'bound':5A,33B,44B,79C,85C 'cellular':24B 'check':34B,86C 'chipsets':22A 'connect':51B,99C 'control':56B,105C 'could':88C 'cve':14A,17A 'devic':29B,49B 'due':81C 'escal':12A,64B,92C 'execut':112C 'exploit':121C 'firmwar':38B 'id':123C,126C 'infrastructur':25B 'interact':70B,116C 'issu':125C 'lead':89C 'let':7A 'mediatek':20A,26B 'miss':32B,84C 'mobil':28B 'mobile-devic':27B 'modem':1A,21A,30B,37B,72C 'moly01876662':124C 'msv':127C 'need':114C,119C 'out-of-bound':2A,41B 'patch':122C 'phone':47B 'possibl':76C 'privileg':13A,65B,94C,113C 'push':62B 'remot':66B,91C 'rogu':9A,57B,102C 'station':11A,59B,104C 'ue':97C 'user':69B,115C 'write':6A,45B,80C","nicknames":[],"mitigations":[],"who_affected":"Phones, tablets and other devices built on the MediaTek chipsets listed in the November 2026 MediaTek bulletin (for example MT6878, MT6985, MT6991, MT2735). Exposure needs the device to connect to an attacker-run rogue base station; no user interaction is needed. Devices without a MediaTek modem, or without cellular, can skip it.","tier":"B","verified":{"who_affected":{"at":"2026-11-02T03:33:47Z","by":"analyst","doc":"https://www.mediatek.com/product-security-bulletin/november-2026","run_id":1341}},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Install the next security update for your phone from its maker when it is offered: Settings > System > Software update.","pkeys":["mediatekmodemchipsets","modemchipsets"],"ptokens":["chipsets","mediatek","modem"],"labels":["android","cellular","high","infrastructure","mediatek","mobiledevices","modem"],"first_public_at":"2026-11-02T03:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20556","severity":null,"published_at":"2026-11-02T03:17:32+00:00","modified_at":"2026-11-02T03:17:32+00:00","first_seen_at":"2026-11-02T03:31:24+00:00","fetched_at":"2026-11-02T03:31:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-20556:1341","url":null,"severity":null,"published_at":"2026-11-02T03:33:47+00:00","modified_at":"2026-11-02T03:33:47+00:00","first_seen_at":"2026-11-02T03:33:47+00:00","fetched_at":"2026-11-02T03:33:47+00:00","note":"MediaTek Nov 2026 bulletin read: CVE-2026-20556 modem OOB write (CWE-787), High, internal report, 54 chipsets listed, no exploitation known per MediaTek. Bulletin gives no patch level/versions; OEMs were notified 2+ months ago. Fix unknown."}],"documents":[{"id":42096,"url":"https://www.mediatek.com/product-security-bulletin/november-2026","title":"MediaTek Product Security Bulletin, November 2026","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}