CVE-2026-20534: CWE-125 Out-of-bounds Read in MediaTek, Inc. MediaTek chipset

The vulnerability identified as CVE-2026-20534 involves an out-of-bounds read in the modem of MediaTek chipsets due to an incorrect bounds check. This flaw can be triggered remotely by an attacker controlling a rogue base station to cause a denial of service condition on the affected device. No additional execution privileges or user interaction are required for exploitation. The issue is tracked under MediaTek's internal ID MSV-9155 and patch ID MOLY01797547. A wide range of MediaTek chipset models are affected, including MT2716, MT2735, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6833, MT6853, MT6855, MT6873, MT6880, MT6890, MT6980, MT6990, MT8666, MT8675, MT8755, MT8765, MT8771, MT8781, MT8786, MT8791, MT8796, MT8863, MT8873, MT8883, and MT8893 among others. No CVSS score is provided, and no known exploits in the wild have been reported.

The vulnerability allows a remote attacker controlling a rogue base station to cause a denial of service on affected MediaTek chipsets by triggering an out-of-bounds read. This can disrupt device operation without requiring user interaction or elevated privileges. There is no indication of code execution or data disclosure from the provided information.

The vendor has assigned a patch ID (MOLY01797547) indicating that a fix exists. Users and device manufacturers should apply the official patch provided by MediaTek to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying firmware or software updates from the vendor or device OEM. Patch status is confirmed by the vendor's internal tracking and patch ID. No additional mitigation steps are indicated.