CVE-2026-20403

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20403", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2025-11-03T01:30:59.007Z", "datePublished": "2026-02-02T08:14:45.891Z", "dateUpdated": "2026-03-30T13:02:43.931Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-03-30T13:02:43.931Z"}, "descriptions": [{"lang": "en", "value": "In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01689254 (Note: For N15 and NR16) / MOLY01689259 (Note: For NR17 and NR17R); Issue ID: MSV-4843."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "defaultStatus": "unaffected", "versions": [{"version": "MT2735", "status": "affected"}, {"version": "MT2737", "status": "affected"}, {"version": "MT6813", "status": "affected"}, {"version": "MT6815", "status": "affected"}, {"version": "MT6833", "status": "affected"}, {"version": "MT6835", "status": "affected"}, {"version": "MT6853", "status": "affected"}, {"version": "MT6855", "status": "affected"}, {"version": "MT6873", "status": "affected"}, {"version": "MT6875", "status": "affected"}, {"version": "MT6877", "status": "affected"}, {"version": "MT6878", "status": "affected"}, {"version": "MT6879", "status": "affected"}, {"version": "MT6880", "status": "affected"}, {"version": "MT6883", "status": "affected"}, {"version": "MT6885", "status": "affected"}, {"version": "MT6886", "status": "affected"}, {"version": "MT6889", "status": "affected"}, {"version": "MT6890", "status": "affected"}, {"version": "MT6891", "status": "affected"}, {"version": "MT6893", "status": "affected"}, {"version": "MT6895", "status": "affected"}, {"version": "MT6896", "status": "affected"}, {"version": "MT6897", "status": "affected"}, {"version": "MT6899", "status": "affected"}, {"version": "MT6980", "status": "affected"}, {"version": "MT6983", "status": "affected"}, {"version": "MT6985", "status": "affected"}, {"version": "MT6989", "status": "affected"}, {"version": "MT6990", "status": "affected"}, {"version": "MT6991", "status": "affected"}, {"version": "MT6993", "status": "affected"}, {"version": "MT8673", "status": "affected"}, {"version": "MT8675", "status": "affected"}, {"version": "MT8676", "status": "affected"}, {"version": "MT8771", "status": "affected"}, {"version": "MT8791", "status": "affected"}, {"version": "MT8791T", "status": "affected"}, {"version": "MT8795T", "status": "affected"}, {"version": "MT8797", "status": "affected"}, {"version": "MT8798", "status": "affected"}, {"version": "MT8893", "status": "affected"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/February-2026"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T14:15:17.296300Z", "id": "CVE-2026-20403", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:15:26.288Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-20403", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T14:15:17.296300Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T21:18:20.464Z"}}], "cna": {"affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "versions": [{"status": "affected", "version": "MT2735"}, {"status": "affected", "version": "MT2737"}, {"status": "affected", "version": "MT6813"}, {"status": "affected", "version": "MT6815"}, {"status": "affected", "version": "MT6833"}, {"status": "affected", "version": "MT6835"}, {"status": "affected", "version": "MT6853"}, {"status": "affected", "version": "MT6855"}, {"status": "affected", "version": "MT6873"}, {"status": "affected", "version": "MT6875"}, {"status": "affected", "version": "MT6877"}, {"status": "affected", "version": "MT6878"}, {"status": "affected", "version": "MT6879"}, {"status": "affected", "version": "MT6880"}, {"status": "affected", "version": "MT6883"}, {"status": "affected", "version": "MT6885"}, {"status": "affected", "version": "MT6886"}, {"status": "affected", "version": "MT6889"}, {"status": "affected", "version": "MT6890"}, {"status": "affected", "version": "MT6891"}, {"status": "affected", "version": "MT6893"}, {"status": "affected", "version": "MT6895"}, {"status": "affected", "version": "MT6896"}, {"status": "affected", "version": "MT6897"}, {"status": "affected", "version": "MT6899"}, {"status": "affected", "version": "MT6980"}, {"status": "affected", "version": "MT6983"}, {"status": "affected", "version": "MT6985"}, {"status": "affected", "version": "MT6989"}, {"status": "affected", "version": "MT6990"}, {"status": "affected", "version": "MT6991"}, {"status": "affected", "version": "MT6993"}, {"status": "affected", "version": "MT8673"}, {"status": "affected", "version": "MT8675"}, {"status": "affected", "version": "MT8676"}, {"status": "affected", "version": "MT8771"}, {"status": "affected", "version": "MT8791"}, {"status": "affected", "version": "MT8791T"}, {"status": "affected", "version": "MT8795T"}, {"status": "affected", "version": "MT8797"}, {"status": "affected", "version": "MT8798"}, {"status": "affected", "version": "MT8893"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/February-2026"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01689254 (Note: For N15 and NR16) / MOLY01689259 (Note: For NR17 and NR17R); Issue ID: MSV-4843."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-03-30T13:02:43.931Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20403", "state": "PUBLISHED", "dateUpdated": "2026-03-30T13:02:43.931Z", "dateReserved": "2025-11-03T01:30:59.007Z", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "datePublished": "2026-02-02T08:14:45.891Z", "assignerShortName": "MediaTek"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MediaTek chipset", "vendor": "MediaTek, Inc.", "versions": [{"status": "affected", "version": "MT2735"}, {"status": "affected", "version": "MT2737"}, {"status": "affected", "version": "MT6813"}, {"status": "affected", "version": "MT6815"}, {"status": "affected", "version": "MT6833"}, {"status": "affected", "version": "MT6835"}, {"status": "affected", "version": "MT6853"}, {"status": "affected", "version": "MT6855"}, {"status": "affected", "version": "MT6873"}, {"status": "affected", "version": "MT6875"}, {"status": "affected", "version": "MT6877"}, {"status": "affected", "version": "MT6878"}, {"status": "affected", "version": "MT6879"}, {"status": "affected", "version": "MT6880"}, {"status": "affected", "version": "MT6883"}, {"status": "affected", "version": "MT6885"}, {"status": "affected", "version": "MT6886"}, {"status": "affected", "version": "MT6889"}, {"status": "affected", "version": "MT6890"}, {"status": "affected", "version": "MT6891"}, {"status": "affected", "version": "MT6893"}, {"status": "affected", "version": "MT6895"}, {"status": "affected", "version": "MT6896"}, {"status": "affected", "version": "MT6897"}, {"status": "affected", "version": "MT6899"}, {"status": "affected", "version": "MT6980"}, {"status": "affected", "version": "MT6983"}, {"status": "affected", "version": "MT6985"}, {"status": "affected", "version": "MT6989"}, {"status": "affected", "version": "MT6990"}, {"status": "affected", "version": "MT6991"}, {"status": "affected", "version": "MT6993"}, {"status": "affected", "version": "MT8673"}, {"status": "affected", "version": "MT8675"}, {"status": "affected", "version": "MT8676"}, {"status": "affected", "version": "MT8771"}, {"status": "affected", "version": "MT8791"}, {"status": "affected", "version": "MT8791T"}, {"status": "affected", "version": "MT8795T"}, {"status": "affected", "version": "MT8797"}, {"status": "affected", "version": "MT8798"}, {"status": "affected", "version": "MT8893"}]}], "source": "security@mediatek.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:*", "matchCriteriaId": "E30A2D2E-6A72-4070-A471-EEE75F7D07F2", "vulnerable": true}, {"criteria": "cpe:2.3:o:mediatek:nr16:-:*:*:*:*:*:*:*", "matchCriteriaId": "2B763B71-F913-45B4-B91E-D7F0670C4315", "vulnerable": true}, {"criteria": "cpe:2.3:o:mediatek:nr17:-:*:*:*:*:*:*:*", "matchCriteriaId": "66F8874B-DBF1-4A67-8ADF-4654AB56B6A8", "vulnerable": true}, {"criteria": "cpe:2.3:o:mediatek:nr17r:-:*:*:*:*:*:*:*", "matchCriteriaId": "BC63582A-F9A5-4450-A263-CE1FD4B4F3AC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*", "matchCriteriaId": "7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*", "matchCriteriaId": "9C2A1118-B5F7-4EF5-B329-0887B5F3430E", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*", "matchCriteriaId": "66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*", "matchCriteriaId": "B7122918-8C44-4F24-82E4-B8448247FC83", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*", "matchCriteriaId": "9814939B-F05E-4870-90C0-7C0F6BAAEB39", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*", "matchCriteriaId": "19A63103-C708-48EC-B44D-5E465A6B79C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*", "matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*", "matchCriteriaId": "89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*", "matchCriteriaId": "F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*", "matchCriteriaId": "80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*", "matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*", "matchCriteriaId": "855A8046-34ED-4891-ACE5-76AB10AC8D53", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*", "matchCriteriaId": "704BE5CE-AE08-4432-A8B0-4C8BD62148AD", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*", "matchCriteriaId": "68CF4A7A-3136-4C4C-A795-81323896BE11", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*", "matchCriteriaId": "15E2EC3F-9FB3-488B-B1C1-2793A416C755", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD64413C-C774-4C4F-9551-89E1AA9469EE", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*", "matchCriteriaId": "AF3E2B84-DAFE-4E11-B23B-026F719475F5", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*", "matchCriteriaId": "3B787DC3-8E5A-4968-B20B-37B6257FAAE2", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*", "matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*", "matchCriteriaId": "D8E91CA4-CA5B-40D1-9A96-2B875104BCF4", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*", "matchCriteriaId": "213B5C7F-D965-4312-9CDF-4F06FA77D401", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*", "matchCriteriaId": "E0CA45C9-7BFE-4C93-B2AF-B86501F763AB", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*", "matchCriteriaId": "33DEF766-EAF1-4E36-BB7C-43069B26507A", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A7D8055-F4B6-41EE-A078-11D56285AB66", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*", "matchCriteriaId": "C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*", "matchCriteriaId": "BA9131F6-F167-4FD7-8FBF-B372CBBCF46F", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*", "matchCriteriaId": "EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*", "matchCriteriaId": "EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*", "matchCriteriaId": "AD7DE6B2-66D9-4A3E-B15F-D56505559255", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*", "matchCriteriaId": "1A76806D-A4E3-466A-90CB-E9FFE478E7A0", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*", "matchCriteriaId": "CBBB30DF-E963-4940-B742-F6801F68C3FC", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*", "matchCriteriaId": "57E92BE0-5E65-4770-8E1A-0E5D07A38164", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*", "matchCriteriaId": "152F6606-FA23-4530-AA07-419866B74CB3", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*", "matchCriteriaId": "03E6123A-7603-4EAB-AFFB-229E8A040709", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*", "matchCriteriaId": "EE302F6F-170E-4350-A8F4-65BE0C50CB78", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*", "matchCriteriaId": "0D09F23D-D023-4A60-B426-61251FDD8A5A", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*", "matchCriteriaId": "9CD2C3EC-B62D-4616-964F-FDBE5B14A449", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*", "matchCriteriaId": "1BB05B1D-77C9-4E42-91AD-9F087413DC20", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*", "matchCriteriaId": "78D4E9E1-B044-41EC-BE98-22DC0E5E9010", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*", "matchCriteriaId": "2B469BF4-5961-42E9-814B-1BE06D182E45", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*", "matchCriteriaId": "637CAAD2-DCC0-4F81-B781-5D0536844CA8", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*", "matchCriteriaId": "CCFAADB1-C2B2-47A6-BB66-761B964E7DFB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01689254 (Note: For N15 and NR16) / MOLY01689259 (Note: For NR17 and NR17R); Issue ID: MSV-4843."}, {"lang": "es", "value": "En el m\u00f3dem, existe una posible ca\u00edda del sistema debido a una comprobaci\u00f3n de l\u00edmites faltante. Esto podr\u00eda llevar a una denegaci\u00f3n de servicio remota, si un UE se ha conectado a una estaci\u00f3n base maliciosa controlada por el atacante, sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n. ID del parche: MOLY01689254 (Nota: Para N15 y NR16) / MOLY01689259 (Nota: Para NR17 y NR17R); ID del problema: MSV-4843."}], "id": "CVE-2026-20403", "lastModified": "2026-06-17T10:17:21.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20403", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T14:15:17.296300Z", "version": "2.0.3"}}]}, "published": "2026-02-02T09:15:54.963", "references": [{"source": "security@mediatek.com", "tags": ["Vendor Advisory"], "url": "https://corp.mediatek.com/product-security-bulletin/February-2026"}], "sourceIdentifier": "security@mediatek.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "security@mediatek.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T07:13:00.129463+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011supplied firmware patch MOLY01689254 for N15 and NR16 devices or MOLY01689259 for NR17 and NR17R devices", "Upgrade the device firmware to the latest version that includes the patch", "Restrict device connectivity to authenticated base stations or disable external network interfaces that are not required"], "summary": {"action": "Apply Patch", "impact": "Remote Denial of Service"}, "threat_synthesis": {"affected_systems": "Affected products include a broad range of MediaTek hardware, such as MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6983, MT6985, MT6989, MT6990, MT6991, MT6993, MT8673, MT8675, MT8676, MT8771, MT8791, MT8791t, MT8795t, MT8797, MT8798, MT8893, as well as various networking modules (e.g., NR15, NR16, NR17, NR17r). The vendor has issued firmware patch IDs MOLY01689254 for N15 and NR16 devices and MOLY01689259 for NR17 and NR17R devices.", "description_and_impact": "The vulnerability arises from a missing bounds check in the modem firmware of MediaTek chipsets. An attacker can trigger a system crash by sending specially crafted data, causing the modem process to terminate. The crash manifests as a denial of service, denying normal network functions to the user device.", "risk_and_exploitability": "The CVSS score is 6.5, indicating moderate severity, while the EPSS score is less than 1\u202f% showing a low probability of exploitation. The vulnerability is not present in the CISA KEV catalog. An attacker can exploit this by remotely sending malformed data to the modem, for example from a rogue base station that a user device connects to. No user interaction and no extra privileges are required, making the attack vector purely remote network based."}}}}, "created": "2026-02-04T12:45:00.376661+00:00", "title": "Modem Crash due to Missing Bounds Check Leading to Remote Denial of Service", "updated": "2026-04-16T07:15:28.177906+00:00", "vendors": ["mediatek", "mediatek$PRODUCT$mt2735", "mediatek$PRODUCT$mt2737", "mediatek$PRODUCT$mt6813", "mediatek$PRODUCT$mt6815", "mediatek$PRODUCT$mt6833", "mediatek$PRODUCT$mt6835", "mediatek$PRODUCT$mt6853", "mediatek$PRODUCT$mt6855", "mediatek$PRODUCT$mt6873", "mediatek$PRODUCT$mt6875", "mediatek$PRODUCT$mt6877", "mediatek$PRODUCT$mt6878", "mediatek$PRODUCT$mt6879", "mediatek$PRODUCT$mt6880", "mediatek$PRODUCT$mt6883", "mediatek$PRODUCT$mt6885", "mediatek$PRODUCT$mt6886", "mediatek$PRODUCT$mt6889", "mediatek$PRODUCT$mt6890", "mediatek$PRODUCT$mt6891", "mediatek$PRODUCT$mt6893", "mediatek$PRODUCT$mt6895", "mediatek$PRODUCT$mt6896", "mediatek$PRODUCT$mt6897", "mediatek$PRODUCT$mt6899", "mediatek$PRODUCT$mt6980", "mediatek$PRODUCT$mt6983", "mediatek$PRODUCT$mt6985", "mediatek$PRODUCT$mt6989", "mediatek$PRODUCT$mt6990", "mediatek$PRODUCT$mt6991", "mediatek$PRODUCT$mt6993", "mediatek$PRODUCT$mt8673", "mediatek$PRODUCT$mt8675", "mediatek$PRODUCT$mt8676", "mediatek$PRODUCT$mt8771", "mediatek$PRODUCT$mt8791", "mediatek$PRODUCT$mt8791t", "mediatek$PRODUCT$mt8795t", "mediatek$PRODUCT$mt8797", "mediatek$PRODUCT$mt8798", "mediatek$PRODUCT$mt8893"]}