CVE-2026-20434

State: Published
Severity: 7.5 High
Published: Mar 2, 2026
Updated: Mar 30, 2026
Reserved: Nov 3, 2025

Description

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY00782946; Issue ID: MSV-4135.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
MediaTek chipsetMediaTek, Inc.	MT2735Affected MT2737Affected MT6739Affected MT6761Affected MT6762Affected MT6762DAffected MT6762MAffected MT6763Affected MT6765Affected MT6765TAffected MT6767Affected MT6768Affected MT6769Affected MT6769KAffected MT6769SAffected MT6769TAffected MT6769ZAffected MT6771Affected MT6779Affected MT6781Affected MT6783Affected MT6785Affected MT6785TAffected MT6785UAffected MT6789Affected and 69 more versions

Product

Versions

MediaTek chipsetMediaTek, Inc.

MT2735Affected
MT2737Affected
MT6739Affected
MT6761Affected
MT6762Affected
MT6762DAffected
MT6762MAffected
MT6763Affected
MT6765Affected
MT6765TAffected
MT6767Affected
MT6768Affected
MT6769Affected
MT6769KAffected
MT6769SAffected
MT6769TAffected
MT6769ZAffected
MT6771Affected
MT6779Affected
MT6781Affected
MT6783Affected
MT6785Affected
MT6785TAffected
MT6785UAffected
MT6789Affected
and 69 more versions

References

https://corp.mediatek.com/product-security-bulletin/March-2026

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.