CVE-2026-20461

MEDIUM

MediaTek Chipset - Out-of-bounds Write

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-20461. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-20461, a missing bounds check in a modem component leading to a potential remote denial-of-service (DoS). The code lacks actual exploit implementation and only includes placeholder logic for target probing.

Description

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01267281 / MOLY01318201; Issue ID: MSV-6486.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-20461_modem_there.py

This repository contains an auto-generated stub module for CVE-2026-20461, a missing bounds check in a modem component leading to a potential remote denial-of-service (DoS). The code lacks actual exploit implementation and only includes placeholder logic for target probing.

Classification
Stub 99%
Attack Type
Dos
Complexity
Complex
Reliability
Theoretical
Target: Modem (unspecified vendor, likely MediaTek based on references)
No auth needed
Prerequisites: Target device must connect to a rogue base station controlled by the attacker · Attacker must have knowledge of the specific modem firmware and vulnerable code path
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

Scores

CVSS v3 5.3
EPSS 0.0018
EPSS Percentile 7.9%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-787
Status published
Products (33)
MediaTek, Inc./MediaTek chipset MT2737
MediaTek, Inc./MediaTek chipset MT6813
MediaTek, Inc./MediaTek chipset MT6835
MediaTek, Inc./MediaTek chipset MT6858
MediaTek, Inc./MediaTek chipset MT6878
MediaTek, Inc./MediaTek chipset MT6879
MediaTek, Inc./MediaTek chipset MT6886
MediaTek, Inc./MediaTek chipset MT6895
MediaTek, Inc./MediaTek chipset MT6896
MediaTek, Inc./MediaTek chipset MT6897
... and 23 more
Published Jul 01, 2026
Tracked Since Jul 01, 2026