---
id: "CVE-2026-20556"
kind: "vulnerability"
aliases: ["CVE-2026-20556"]
title: "Modem: out-of-bounds write lets a rogue base station escalate privilege"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "MediaTek modem chipsets", "fixed": [], "affected": "MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893", "ecosystem": "vendor"}]
ecosystems: []
tags: ["android", "cellular", "infrastructure", "mediatek", "mobile-devices", "modem"]
not_affected_if: ["no-cellular-modem", "non-mediatek-chipset"]
published_at: "2026-11-02T03:17:32+00:00"
first_seen_at: "2026-11-02T03:31:24+00:00"
updated_at: "2026-11-02T03:33:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20556", "first_seen_at": "2026-11-02T03:31:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T03:33:47+00:00"}]
---

# Modem: out-of-bounds write lets a rogue base station escalate privilege

A missing bounds check in the modem firmware allows an out-of-bounds write. A phone or device that connects to an attacker-controlled rogue base station can be pushed to escalate privilege remotely, with no user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MediaTek modem chipsets affected MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893 fixed ?

## How to check

Find your device's chipset (Settings > About phone, or the maker's spec sheet) and compare with the chipsets in the MediaTek November 2026 bulletin. Then check that the device maker's security update dated 2026-11-01 or later is installed; MediaTek's bulletin does not name the patch level, so ask the maker which build carries MOLY01876662.

## Timeline

- 2026-11-02T03:31:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-20556
- 2026-11-02T03:33:47+00:00 analyst — MediaTek Nov 2026 bulletin read: CVE-2026-20556 modem OOB write (CWE-787), High, internal report, 54 chipsets listed, no exploitation known per MediaTek. Bulletin gives no patch level/versions; OEMs were notified 2+ months ago. Fix unknown.

## Documents

- [advisory] MediaTek Product Security Bulletin, November 2026 https://www.mediatek.com/product-security-bulletin/november-2026

## From the sources

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876662; Issue ID: MSV-9833.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_