CVE-2026-20527: CWE-129 Improper Validation of Array Index in MediaTek, Inc. MediaTek chipset
Description
CVE-2026-20527 is a vulnerability in MediaTek chipsets caused by improper validation of array indices in the modem component. This flaw can lead to a system crash resulting in a remote denial of service (DoS) if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional execution privileges. A patch is referenced by MediaTek with Patch IDs MOLY01864925 and MOLY01210562.
Affected software
MediaTek, Inc.
MediaTek chipset
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-129) in MediaTek chipsets arises from a missing bounds check in the modem software, allowing an attacker controlling a rogue base station to cause a system crash remotely. The issue affects multiple MediaTek chipset models explicitly listed. Exploitation requires no user interaction or elevated privileges. MediaTek has issued patches identified by MOLY01864925 and MOLY01210562 to address this flaw.
Potential Impact
Successful exploitation results in a remote denial of service condition on affected devices by causing a system crash. This can disrupt normal device operation when connected to a malicious base station. No further execution privileges are gained by the attacker.
Mitigation Recommendations
MediaTek has released patches identified as MOLY01864925 and MOLY01210562 to fix this vulnerability. Users and device manufacturers should apply these official fixes to mitigate the risk. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- MediaTek
- Date Reserved
- 2025-11-03T01:30:59.034Z
- State
- PUBLISHED
Threat ID: 6ac309152cdf04f656a0bf9a
Added to database: 10/05/2026, 02:19:01 UTC
Last enriched: 10/05/2026, 02:34:42 UTC
Last updated: 10/05/2026, 02:48:16 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.