MediaTek's October 2026 bulletin silences 31 flaws, led by two critical modem bugs

MediaTek has released its October 2026 security bulletin, published on 5 October, addressing 31 vulnerabilities across its smartphone, automotive, tablet and IoT platforms. Two of the flaws are rated critical: CVE-2026-20519 and CVE-2026-20520, both in the modem. The company says device makers received the fixes at least two months before public disclosure, and that it is "not aware of any active exploitation of these vulnerabilities in the wild." No public proof-of-concept has been confirmed either.

Two critical bugs, one attack model

Both critical flaws are out-of-bounds writes caused by missing bounds checks in MediaTek's modem stack, classified under CWE-787. The National Vulnerability Database scores the lead bug at CVSS 7.5 high (AV:A/AC:H/PR:N/UI:N), and describes the exploit chain the way every carrier in the list does it: if a device connects to a rogue base station controlled by the attacker, the modem can be pushed into writing out of bounds, enabling remote privilege escalation — with no user interaction and no additional privileges required. The attack window is the adjacent-network range, which makes café-side coffee-shop Wi-Fi the wrong setting but makes a phone parked inside a city the right one.

The reach of the two critical flaws is the headline. They cover a long slate of chipsets, spanning the MT6833, MT6853, MT6877 and MT6893 smartphone families, the MT6983, MT6985, MT6989, MT6991 and MT6993 flagship parts, the MT87xx and MT88xx tablet and Chromebook lines, and the MT2735 and MT2737 automotive and IoT modems. That is more than 50 distinct chipsets across the phone, automotive and consumer lines combined.

The rest of the bulletin

• CVE-2026-20526 — another modem flaw that reaches a similar impact but requires user interaction.
• CVE-2026-20586 — an out-of-bounds write in the video decoder (vdec) that can lead to remote privilege escalation when a user opens crafted content.
• CVE-2026-20525 and CVE-2026-20527 — modem bugs that let a rogue base station crash the device, a remote denial-of-service path.
• Remaining high-severity flaws in the NeuroPilot AI framework, APU driver and video HAL, each giving a local attacker a privilege-escalation foothold.
• 20 medium-severity flaws that mostly require system privileges and span mtee, aidl, display, battery and ccci; several of these also allow a remote denial of service via a rogue base station.

What this means for you

The critical pair is the one to focus on because it removes the usual user-interaction requirement: a phone parked inside a city, on its normal cell connection, is inside the attacker's window. There is no active exploitation yet, but a rogue-base-station attack is a low-cost, high-reach vector if the target is a device whose software has not been updated — and MediaTek's two-month OEM lead time is the mitigation, not anything a user can do directly. The practical takeaway for device owners is a familiar one: install your phone maker's monthly or bi-monthly security update and watch for a security-patch-level jump. Devices that ship on older firmware or that stop shipping updates are the exposure surface this bulletin is most likely to matter for.

The broader read is that modem-stack memory corruption is still one of the most durable remote-attack vectors in mobile security, and vendors like MediaTek are the ones closing the most of it. The question going into the next cycle is not whether the criticals will be exploited, but whether any OEM will be slow enough to be caught.

Sources: MediaTek Product Security Bulletin: October 2026; MediaTek October 2026 bulletin fixes 31 flaws (SecurityOnline); MediaTek fixes 31 chipset vulnerabilities (CyberPress).

Corrections: Report an error at corrections@wireshaman.com.