CVE-2026-20539

Executive Summary

CVE-2026-20539 is an out-of-bounds read (CWE-126) in the Modem component of MediaTek MT2716 firmware, caused by a missing bounds check on attacker-influenced input. The flaw is remotely triggerable by a rogue base station (false eNodeB/gNB) when a user equipment (UE) device built on the affected chipset has connected to it; no user interaction and no additional execution privileges are required on the target. Impact is limited to availability (CVSS:3.1 base 5.3, A:H), producing a remote denial of service of the modem/connectivity stack on affected devices.

Technical Analysis

Per the NVD description, the vulnerability resides in the Modem subsystem of MediaTek MT2716 firmware and is classified as an out-of-bounds read resulting from a missing bounds check. CWE-126 (Buffer Over-read) means the code reads beyond the boundary of an allocated buffer because the size or index used to gate the read is not validated before use. In a modem protocol stack, such reads typically occur while parsing a network-originated message — a length, count, or offset field supplied over the radio interface is trusted and used to drive a memory access without being clamped to the size of the destination buffer.

Two properties of this CVE shape the attack surface:

1. Attack vector is adjacent (AV:A). The flaw is reachable only over the cellular radio link. The attacker must control the base station the UE attaches to, i.e., a rogue/false base station. It is not exploitable over the internet and cannot be reached through ordinary IP networking.
2. Attacker-controlled input path. Because the trigger is a network message from the rogue base station, the malformed field that bypasses the missing bounds check is fully attacker-controlled. Attack complexity is rated High (AC:H), consistent with the requirement to successfully stand up and maintain a rogue base station that the target UE will select and camp on, and to deliver a message that reaches the vulnerable modem parsing path.
3. No privileges or user action. PR:N and UI:N indicate the read is reached during normal modem message processing; the victim does not have to approve, click, or install anything. Connection to the rogue cell is sufficient.

The NVD text does not disclose the specific parser, message type, field, or function involved, and the CNA title is empty. This report therefore does not name any internal function, message name, or file path; those details are not available in the supplied data. The patch reference given is Patch ID MOLY01774038 with Issue ID MSV-8913, but no vendor advisory, version mapping, or fix confirmation was located by any tracked source, so the affected firmware version range is unknown.

Because the consequence described is a read (not a write), the expected outcome is not code execution: it is a crash, abort, or hang of the modem processing context when the out-of-bounds access touches unmapped or protected memory. That maps directly to the CVSS impact subscore C:N/I:N/A:H — no confidentiality or integrity impact is claimed, only availability loss.

Exploitation Scenarios

No public proof-of-concept exists for this CVE; the attack chain below is inferred strictly from the vulnerability class (CWE-126 via a missing bounds check) and the NVD-described precondition (UE connected to an attacker-controlled rogue base station).

1. Reconnaissance / target identification. The attacker identifies victim UEs in radio range. Because the flaw is in the MT2716 modem, the relevant target set is devices built on that MediaTek platform. The attacker does not need prior knowledge of the handset model at the RF layer — they need the victim to select and camp on the attacker's cell.

2. Rogue base station setup. The attacker operates a software-defined-radio base station (false eNodeB/gNB) that advertises a cell the victim UE will reselect to — typically by broadcasting a higher-priority or stronger signal, or by impersonating a legitimate public land mobile network. This is the step that justifies AC:H: the rogue cell must be built, tuned, and made attractive enough for the UE to attach. Once the UE has connected, the precondition stated in the NVD description is satisfied.

3. Triggering the flaw class. With the UE camped on the rogue cell, the attacker sends a network-originated modem message containing a length, count, or offset field whose value exceeds the size of the buffer the modem will read into. Because the missing bounds check does not clamp that value, the modem reads past the end of the buffer (out-of-bounds read). No user interaction is required; the malformed message is processed as part of normal modem signaling. No specific message type or field is identified in the available data — only the vulnerability class can be stated.

4. Post-exploitation impact. The out-of-bounds read causes the affected modem processing path to fault, producing a denial of service: loss of cellular connectivity (and potentially a modem or device reset, depending on how the firmware handles the fault). There is no described path to code execution, data exfiltration, or persistent compromise, consistent with the CVSS vector's C:N/I:N/A:H. The effect is transient from the network side — the attacker can re-trigger it as long as the UE remains in range and re-selects the rogue cell — but it does not survive as an implant, because no write or code-execution primitive is described.

Impact Assessment

• Availability (A:H). The primary and only claimed impact. A successful trigger disrupts the modem, taking the device off the cellular network for the duration of the fault and recovery. For handsets this means loss of voice and data service; for any non-handset system using MT2716 (e.g., embedded/automotive/CPE-class designs), it can mean loss of the platform's primary WAN link.
• Confidentiality (C:N) and Integrity (I:N). No confidentiality or integrity impact is asserted by the vector. The vulnerability is a read, not a write, and no memory-disclosure outcome is claimed.
• Scope (S:U). Impact is confined to the vulnerable modem component; no scope change.
• Blast radius. Localized to UEs that (a) are built on the affected MediaTek MT2716 firmware and (b) connect to an attacker-controlled base station. It is not wormable and does not spread over IP networks. The blast radius in practice is bounded by radio range and by the attacker's ability to stand up and maintain a rogue cell — which is why AC is High.
• CVSS 3.1 base: 5.3 (Medium) — AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
• EPSS: 0.00182 (≈7.1st percentile). Low predicted likelihood of exploitation in the near term, consistent with the adjacent, high-complexity attack requirements. Not listed in CISA KEV.

Detection Guidance

Detection for this CVE is difficult from the endpoint side because the trigger is a malformed over-the-air modem message. Network-side detection is only feasible where baseband/RF telemetry is available (e.g., test UEs, modem debug/trace interfaces, or core-network-side monitoring of anomalous cell behavior). The rules below target modem fault telemetry, rogue-cell indicators, and modem crash signatures.

Sigma Rule

title: MediaTek Modem Out-of-Bounds Read / Modem Fault (CVE-2026-20539)
id: 9c1d7a54-2b6e-4f0a-9d3c-7a5e1f2b8c40
status: experimental
description: Detects modem subsystem faults consistent with an out-of-bounds read triggered by a rogue base station against MediaTek MT2716 firmware.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20539
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: android
detection:
  selection_fault:
    - "modem*"
    - "rild*"
    - "qmi*"
  keywords:
    - "out of bounds"
    - "buffer over-read"
    - "modem crash"
    - "modem reset"
    - "MSV-8913"
  condition: selection_fault and keywords
falsepositives:
  - Benign modem firmware fault dumps during OTA/carrier updates
level: medium

YARA Rule

rule CVE_2026_20539_MediaTek_MT2716_Modem_OOBRead
{
    meta:
        description = "Heuristic detection of MediaTek MT2716 modem firmware artifacts associated with CVE-2026-20539 patch/issue identifiers"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20539"
        date = "2026-01-01"
        hash = "unknown"
    strings:
        $patch = "MOLY01774038" ascii wide
        $issue = "MSV-8913" ascii wide
        $vendor = "MediaTek" ascii wide
        $modem = "modem" ascii nocase
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and (any of ($patch, $issue))
}

Note: The byte-pattern matching above is intentionally limited to the patch/issue identifiers explicitly named in the NVD description, since no binary fingerprint of the vulnerable code is publicly available.

Suricata IDS Rule

No IP-layer signature can reliably detect this flaw: the trigger is a malformed over-the-air modem message between a rogue base station and a UE, which is not visible to standard IP IDS sensors. The rule below is a placeholder that alerts on the CVE identifier appearing in HTTP/PCAP metadata or in test-harness traffic containing the issue ID; it is not a true over-the-air detection.

alert http any any -> any any (msg:"CVE-2026-20539 MediaTek MT2716 modem OOB read - reference/issue ID observed"; flow:established,to_server; content:"MSV-8913"; http_any; classtype:attempted-dos; reference:cve,2026-20539; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-20539; sid:202620539; rev:1;)

Elastic Detection

process where
  process.name : ("rild", "qmi", "modemd") and
  (
    process.command_line : "*modem*crash*" or
    process.command_line : "*out of bounds*" or
    message : "*MSV-8913*" or
    message : "*MOLY01774038*"
  )

Splunk SPL Query

index=android sourcetype=logcat
("modem" OR "rild" OR "qmi" OR "baseband")
("out of bounds" OR "over-read" OR "modem crash" OR "modem reset" OR "MSV-8913" OR "MOLY01774038")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, message
| where count > 1
| sort - last_seen

Wazuh OSSEC Rule

<group name="mediatek,modem,cve-2026-20539,">
  <rule id="2025390" level="8">
    <decoded_as>syslog</decoded_as>
    <match>MSV-8913|MOLY01774038</match>
    <description>CVE-2026-20539: MediaTek MT2716 modem issue/patch identifier observed in logs</description>
    <mitre>
      <id>T1498</id>
    </mitre>
  </rule>
  <rule id="2025391" level="10">
    <decoded_as>syslog</decoded_as>
    <match>modem</match>
    <regex>out of bounds|over-read|modem crash|modem reset</regex>
    <description>CVE-2026-20539: Possible MediaTek modem out-of-bounds read / modem fault</description>
    <mitre>
      <id>T1498</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source. The NVD description references Patch ID MOLY01774038 and Issue ID MSV-8913, but no vendor advisory, fixed firmware version, or affected-version range was retrievable. Treat all MT2716-based firmware as potentially affected until the vendor confirms otherwise.

1) Immediate mitigations (no patch available):

• Track MediaTek's MT2716 firmware advisories and the MSV-8913 / MOLY01774038 identifiers directly with the OEM/silicon vendor; apply the reference patch as soon as the vendor or device OEM publishes it.
• Where the platform permits, disable automatic attachment/reselection to unknown or untrusted cells, and restrict roaming to known operator networks. This reduces exposure to rogue/false base stations, which are the stated trigger precondition.
• Deploy radio-layer monitoring (e.g., rogue-cell / IMSI-catcher detection where lawful and supported) to identify unauthorized base stations operating in sensitive areas.
• For high-assurance or embedded deployments, isolate the modem from safety- or availability-critical functions so a modem fault cannot cascade into a broader system outage.

2) Patch/upgrade steps:

• Obtain the fixed firmware image matching Patch ID MOLY01774038 from MediaTek or the device OEM. Do not assume a generic OS update includes the baseband fix — baseband firmware frequently ships separately from the application processor OS.
• Because the affected version range is unknown, verify the baseband/build version on each device before and after update.
• Re-test that the updated firmware rejects malformed modem messages driving the missing bounds check (bounds validation on attacker-controlled length/count/offset fields).

3) Long-term hardening:

• Require bounds validation on all fields parsed from network-originated modem messages as a standing coding standard for baseband development.
• Prioritize memory-safe patterns and fuzz testing of modem message parsers, since CWE-126 over-reads in protocol parsers are systematically detectable by structured fuzzing.
• Maintain a baseband SBOM and a patch-tracking process that follows MediaTek MSV/MOLY IDs, not just OS-level CVE feeds, so baseband-only fixes are not missed.

References

• NVD — CVE-2026-20539: https://nvd.nist.gov/vuln/detail/CVE-2026-20539
• MediaTek Product Security / MSV advisories (vendor advisory portal; specific advisory not located): https://www.mediatek.com/product-security
• MITRE CWE-126 — Buffer Over-read: https://cwe.mitre.org/data/definitions/126.html
• FIRST EPSS — CVE-2026-20539 score page: https://api.first.org/data/v1/epss?cve=CVE-2026-20539
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-20539 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor note: No public exploit code, Nuclei template, proof-of-concept, or threat-actor campaign has been identified for CVE-2026-20539. The CVE is not listed in CISA KEV, and EPSS is very low (0.00182). Any exploitation would require an attacker-operated rogue base station, which implies a targeted or physically-proximate adversary (e.g., IMSI-catcher-class capability) rather than opportunistic mass exploitation.