CVE-2026-20449_CVE-2026-20449

6.5 / 10

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

In Modem, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01760138; Issue ID: MSV-6148.

Basic Information

ID CVE-2026-20449

Source MediaTek

Published May 4, 2026 at 05:41

Modified May 4, 2026 at 12:59

Affected Product

Vendor MediaTek, Inc.

Product MediaTek chipset

Version MT2735

Affected Versions MediaTek, Inc. MediaTek chipset MT2735
MediaTek, Inc. MediaTek chipset MT2737
MediaTek, Inc. MediaTek chipset MT6739
MediaTek, Inc. MediaTek chipset MT6761
MediaTek, Inc. MediaTek chipset MT6762
MediaTek, Inc. MediaTek chipset MT6763
MediaTek, Inc. MediaTek chipset MT6765
MediaTek, Inc. MediaTek chipset MT6767
MediaTek, Inc. MediaTek chipset MT6768
MediaTek, Inc. MediaTek chipset MT6769
MediaTek, Inc. MediaTek chipset MT6771
MediaTek, Inc. MediaTek chipset MT6779
MediaTek, Inc. MediaTek chipset MT6781
MediaTek, Inc. MediaTek chipset MT6783
MediaTek, Inc. MediaTek chipset MT6785
MediaTek, Inc. MediaTek chipset MT6789
MediaTek, Inc. MediaTek chipset MT6813
MediaTek, Inc. MediaTek chipset MT6815
MediaTek, Inc. MediaTek chipset MT6833
MediaTek, Inc. MediaTek chipset MT6835
MediaTek, Inc. MediaTek chipset MT6853
MediaTek, Inc. MediaTek chipset MT6855
MediaTek, Inc. MediaTek chipset MT6858
MediaTek, Inc. MediaTek chipset MT6873
MediaTek, Inc. MediaTek chipset MT6875
MediaTek, Inc. MediaTek chipset MT6877
MediaTek, Inc. MediaTek chipset MT6878
MediaTek, Inc. MediaTek chipset MT6879
MediaTek, Inc. MediaTek chipset MT6880
MediaTek, Inc. MediaTek chipset MT6883
MediaTek, Inc. MediaTek chipset MT6885
MediaTek, Inc. MediaTek chipset MT6886
MediaTek, Inc. MediaTek chipset MT6889
MediaTek, Inc. MediaTek chipset MT6890
MediaTek, Inc. MediaTek chipset MT6891
MediaTek, Inc. MediaTek chipset MT6893
MediaTek, Inc. MediaTek chipset MT6895
MediaTek, Inc. MediaTek chipset MT6896
MediaTek, Inc. MediaTek chipset MT6897
MediaTek, Inc. MediaTek chipset MT6899
MediaTek, Inc. MediaTek chipset MT6980
MediaTek, Inc. MediaTek chipset MT6983
MediaTek, Inc. MediaTek chipset MT6985
MediaTek, Inc. MediaTek chipset MT6986D
MediaTek, Inc. MediaTek chipset MT6988
MediaTek, Inc. MediaTek chipset MT6989
MediaTek, Inc. MediaTek chipset MT6990
MediaTek, Inc. MediaTek chipset MT6991
MediaTek, Inc. MediaTek chipset MT6993
MediaTek, Inc. MediaTek chipset MT8668
MediaTek, Inc. MediaTek chipset MT8673
MediaTek, Inc. MediaTek chipset MT8675
MediaTek, Inc. MediaTek chipset MT8676
MediaTek, Inc. MediaTek chipset MT8678
MediaTek, Inc. MediaTek chipset MT8755
MediaTek, Inc. MediaTek chipset MT8771
MediaTek, Inc. MediaTek chipset MT8775
MediaTek, Inc. MediaTek chipset MT8791
MediaTek, Inc. MediaTek chipset MT8791T
MediaTek, Inc. MediaTek chipset MT8792
MediaTek, Inc. MediaTek chipset MT8793
MediaTek, Inc. MediaTek chipset MT8795T
MediaTek, Inc. MediaTek chipset MT8797
MediaTek, Inc. MediaTek chipset MT8798
MediaTek, Inc. MediaTek chipset MT8863
MediaTek, Inc. MediaTek chipset MT8873
MediaTek, Inc. MediaTek chipset MT8883
MediaTek, Inc. MediaTek chipset MT8893

CWE Classification

CWE-120

References

corp.mediatek.com /product-security-bulletin/May-2026

{
    "lastseen": "",
    "description": "In Modem, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01760138; Issue ID: MSV-6148.",
    "published": "2026-05-04T05:41:54.581Z",
    "modified": "2026-05-04T12:59:15.818Z",
    "type": "cve",
    "title": "CVE-2026-20449",
    "source": "MediaTek",
    "references": "https://corp.mediatek.com/product-security-bulletin/May-2026",
    "id": "CVE-2026-20449",
    "bulletinFamily": "",
    "cwe": [
        "CWE-120"
    ],
    "cvelist": null,
    "sourceData": "MediaTek, Inc. MediaTek chipset MT2735\nMediaTek, Inc. MediaTek chipset MT2737\nMediaTek, Inc. MediaTek chipset MT6739\nMediaTek, Inc. MediaTek chipset MT6761\nMediaTek, Inc. MediaTek chipset MT6762\nMediaTek, Inc. MediaTek chipset MT6763\nMediaTek, Inc. MediaTek chipset MT6765\nMediaTek, Inc. MediaTek chipset MT6767\nMediaTek, Inc. MediaTek chipset MT6768\nMediaTek, Inc. MediaTek chipset MT6769\nMediaTek, Inc. MediaTek chipset MT6771\nMediaTek, Inc. MediaTek chipset MT6779\nMediaTek, Inc. MediaTek chipset MT6781\nMediaTek, Inc. MediaTek chipset MT6783\nMediaTek, Inc. MediaTek chipset MT6785\nMediaTek, Inc. MediaTek chipset MT6789\nMediaTek, Inc. MediaTek chipset MT6813\nMediaTek, Inc. MediaTek chipset MT6815\nMediaTek, Inc. MediaTek chipset MT6833\nMediaTek, Inc. MediaTek chipset MT6835\nMediaTek, Inc. MediaTek chipset MT6853\nMediaTek, Inc. MediaTek chipset MT6855\nMediaTek, Inc. MediaTek chipset MT6858\nMediaTek, Inc. MediaTek chipset MT6873\nMediaTek, Inc. MediaTek chipset MT6875\nMediaTek, Inc. MediaTek chipset MT6877\nMediaTek, Inc. MediaTek chipset MT6878\nMediaTek, Inc. MediaTek chipset MT6879\nMediaTek, Inc. MediaTek chipset MT6880\nMediaTek, Inc. MediaTek chipset MT6883\nMediaTek, Inc. MediaTek chipset MT6885\nMediaTek, Inc. MediaTek chipset MT6886\nMediaTek, Inc. MediaTek chipset MT6889\nMediaTek, Inc. MediaTek chipset MT6890\nMediaTek, Inc. MediaTek chipset MT6891\nMediaTek, Inc. MediaTek chipset MT6893\nMediaTek, Inc. MediaTek chipset MT6895\nMediaTek, Inc. MediaTek chipset MT6896\nMediaTek, Inc. MediaTek chipset MT6897\nMediaTek, Inc. MediaTek chipset MT6899\nMediaTek, Inc. MediaTek chipset MT6980\nMediaTek, Inc. MediaTek chipset MT6983\nMediaTek, Inc. MediaTek chipset MT6985\nMediaTek, Inc. MediaTek chipset MT6986D\nMediaTek, Inc. MediaTek chipset MT6988\nMediaTek, Inc. MediaTek chipset MT6989\nMediaTek, Inc. MediaTek chipset MT6990\nMediaTek, Inc. MediaTek chipset MT6991\nMediaTek, Inc. MediaTek chipset MT6993\nMediaTek, Inc. MediaTek chipset MT8668\nMediaTek, Inc. MediaTek chipset MT8673\nMediaTek, Inc. MediaTek chipset MT8675\nMediaTek, Inc. MediaTek chipset MT8676\nMediaTek, Inc. MediaTek chipset MT8678\nMediaTek, Inc. MediaTek chipset MT8755\nMediaTek, Inc. MediaTek chipset MT8771\nMediaTek, Inc. MediaTek chipset MT8775\nMediaTek, Inc. MediaTek chipset MT8791\nMediaTek, Inc. MediaTek chipset MT8791T\nMediaTek, Inc. MediaTek chipset MT8792\nMediaTek, Inc. MediaTek chipset MT8793\nMediaTek, Inc. MediaTek chipset MT8795T\nMediaTek, Inc. MediaTek chipset MT8797\nMediaTek, Inc. MediaTek chipset MT8798\nMediaTek, Inc. MediaTek chipset MT8863\nMediaTek, Inc. MediaTek chipset MT8873\nMediaTek, Inc. MediaTek chipset MT8883\nMediaTek, Inc. MediaTek chipset MT8893",
    "sourceHref": "",
    "cvss": {
        "score": 6.5,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "MediaTek chipset",
    "version": "MT2735",
    "vendor": "MediaTek, Inc.",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}