CVE-2026-20541 in MT2716
Summary
by MITRE • 10/05/2026
In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8911.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified under issue identifier MSV-8911 and addressed by patch MOLY01774038 represents a critical security flaw within the modem subsystem of mobile devices, specifically involving an out-of-bounds read condition triggered by a missing permission check. This type of memory safety error occurs when software reads data from a memory location that lies outside the intended buffer or array boundaries. In the context of cellular communication protocols, such flaws are particularly dangerous because they can be exploited remotely without requiring any prior authentication or user interaction. The absence of proper access control mechanisms allows an attacker to manipulate how the modem processes incoming signals, leading to unpredictable behavior in the underlying memory management subsystems that handle radio resource control and physical layer data processing.
The operational impact of this vulnerability is primarily centered around remote denial of service capabilities for connected User Equipment or UE devices. When a mobile device connects to a base station, it engages in complex signaling exchanges governed by standards such as 3GPP LTE or 5G NR protocols. An attacker controlling a rogue base station can craft malicious signal sequences that trigger the out-of-bounds read within the modem firmware. Because this exploitation does not require execution privileges on the host device nor user interaction, the attack surface is significantly expanded. The immediate consequence of triggering this flaw is typically a crash or hang in the modem processor, which effectively disconnects the UE from the network and renders voice and data services unavailable until the device is rebooted or reset. This constitutes a severe availability impact against cellular infrastructure users.
From a technical perspective, this vulnerability aligns with Common Weakness Enumeration category CWE-125, Out-of-bounds Read, where software reads past the end of an allocated buffer due to insufficient boundary checks on input data derived from external sources. The missing permission check indicates a failure in implementing proper authorization controls before processing sensitive modem commands or signal parameters, which also relates to CWE-862 Missing Authorization. In terms of adversary tactics, this exploitation vector maps directly to MITRE ATT&CK technique T1498 Network Denial of Service, specifically sub-technique T1498.003 Wireless Denial of Service, where an attacker uses a rogue access point or base station to disrupt connectivity for wireless devices in the vicinity. The ability to exploit this flaw remotely highlights the risks associated with trusting physical layer signals without sufficient validation and sanitization at the modem firmware level.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements within the modem software development lifecycle. Organizations should prioritize deploying the provided patch MOLY01774038 to update the modem firmware, ensuring that all known memory safety issues are resolved through rigorous static analysis and fuzz testing during development phases. Furthermore, implementing strict input validation for all parameters received from base stations is essential to prevent out-of-bounds access regardless of permission states. Security teams should also consider deploying network-based intrusion detection systems capable of identifying anomalous signaling patterns indicative of rogue base station activity or malformed protocol messages that attempt to trigger such memory errors. Regular security audits focusing on privilege separation and boundary checks in embedded cellular stacks will help reduce the likelihood of similar vulnerabilities emerging in future firmware releases, thereby enhancing the overall resilience of mobile devices against physical-layer attacks.