7.5
High
CVE-2026-20434 In Modem, there is a possible out of bounds write due to a missing bounds check
Description
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY00782946; Issue ID: MSV-4135.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MT2735 | Versions not published | |
| MT2737 | Versions not published | |
| MT6739 | Versions not published | |
| MT6761 | Versions not published | |
| MT6762 | Versions not published | |
| MT6762D | Versions not published | |
| MT6762M | Versions not published | |
| MT6763 | Versions not published | |
| MT6765 | Versions not published |
Show the 86 other branches Hide the 86 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| MT6765T | Versions not published | |
| MT6767 | Versions not published | |
| MT6768 | Versions not published | |
| MT6769 | Versions not published | |
| MT6769K | Versions not published | |
| MT6769S | Versions not published | |
| MT6769T | Versions not published | |
| MT6769Z | Versions not published | |
| MT6771 | Versions not published | |
| MT6779 | Versions not published | |
| MT6781 | Versions not published | |
| MT6783 | Versions not published | |
| MT6785 | Versions not published | |
| MT6785T | Versions not published | |
| MT6785U | Versions not published | |
| MT6789 | Versions not published | |
| MT6833 | Versions not published | |
| MT6833P | Versions not published | |
| MT6835 | Versions not published | |
| MT6835T | Versions not published | |
| MT6853 | Versions not published | |
| MT6853T | Versions not published | |
| MT6855 | Versions not published | |
| MT6855T | Versions not published | |
| MT6873 | Versions not published | |
| MT6875 | Versions not published | |
| MT6875T | Versions not published | |
| MT6877 | Versions not published | |
| MT6877T | Versions not published | |
| MT6877TT | Versions not published | |
| MT6878 | Versions not published | |
| MT6878M | Versions not published | |
| MT6879 | Versions not published | |
| MT6880 | Versions not published | |
| MT6883 | Versions not published | |
| MT6885 | Versions not published | |
| MT6886 | Versions not published | |
| MT6889 | Versions not published | |
| MT6890 | Versions not published | |
| MT6891 | Versions not published | |
| MT6893 | Versions not published | |
| MT6895 | Versions not published | |
| MT6895TT | Versions not published | |
| MT6896 | Versions not published | |
| MT6897 | Versions not published | |
| MT6899 | Versions not published | |
| MT6980 | Versions not published | |
| MT6980D | Versions not published | |
| MT6983 | Versions not published | |
| MT6983T | Versions not published | |
| MT6985 | Versions not published | |
| MT6985T | Versions not published | |
| MT6989 | Versions not published | |
| MT6989T | Versions not published | |
| MT6990 | Versions not published | |
| MT6991 | Versions not published | |
| MT8666 | Versions not published | |
| MT8667 | Versions not published | |
| MT8668 | Versions not published | |
| MT8673 | Versions not published | |
| MT8675 | Versions not published | |
| MT8676 | Versions not published | |
| MT8678 | Versions not published | |
| MT8755 | Versions not published | |
| MT8765 | Versions not published | |
| MT8766 | Versions not published | |
| MT8766R | Versions not published | |
| MT8768 | Versions not published | |
| MT8771 | Versions not published | |
| MT8781 | Versions not published | |
| MT8786 | Versions not published | |
| MT8788 | Versions not published | |
| MT8788E | Versions not published | |
| MT8789 | Versions not published | |
| MT8791 | Versions not published | |
| MT8791T | Versions not published | |
| MT8792 | Versions not published | |
| MT8793 | Versions not published | |
| MT8795T | Versions not published | |
| MT8797 | Versions not published | |
| MT8798 | Versions not published | |
| MT8863 | Versions not published | |
| MT8873 | Versions not published | |
| MT8883 | Versions not published | |
| MT8893 | Versions not published | |
| MediaTek chipset | Versions not published |
References
- corp.mediatek.com corp.mediatek.com
Timeline
- Published
- Last modified
Other CVEs of MT2735
The 14 CVEs of MT2735 →
CVE-2026-20406
In Modem, there is a possible system crash due to an uncaught exception
6.5
Medium
CVE-2026-20405
In Modem, there is a possible system crash due to a missing bounds check
6.5
Medium
CVE-2026-20404
In Modem, there is a possible system crash due to improper input validation
6.5
Medium
CVE-2026-20403
In Modem, there is a possible system crash due to a missing bounds check
6.5
Medium