MediaTek’s November bulletin lists 56 vulnerabilities, including six critical modem flaws

On November 2, 2026, MediaTek published a security bulletin listing six critical, 16 high-severity and 34 medium-severity vulnerabilities, 56 CVEs in all. The six critical entries affect modems; the three highlighted here are part of that group, not the whole set. MediaTek’s bulletin is a separate release from the October bulletin covered earlier by NeoTeo.

Three highlighted critical modem vulnerabilities

MediaTek classifies each of these three CVEs as a CWE-787 out-of-bounds write, a flaw in which software can write beyond the memory space allocated for an operation. The bulletin describes two as involving a missing bounds check and one as involving an incorrectly implemented check.

The bulletin’s six critical CVEs are CVE-2026-20499 and CVE-2026-20545 through CVE-2026-20549. MediaTek assessed severity using CVSS v3.1, the Common Vulnerability Scoring System. It gives a separate affected-chipset list for each CVE, and cautions that those lists may not be complete. For example, MT6815 appears in the lists for CVE-2026-20545 and CVE-2026-20546, but not CVE-2026-20499.

The reported cellular-base-station scenario

CERT Paraguay’s November 3 summary describes a possible scenario for the three CVEs above: an attacker controlling a malicious cellular base station could exploit a vulnerable device when it connects to that station. MediaTek said in its November 2 bulletin that it was not aware of active exploitation in the wild at the time of publication.

MediaTek says OEMs received patches in advance

MediaTek says it notified original equipment manufacturers (OEMs) of all the issues and provided corresponding patches at least two months before publishing the bulletin. It recommends installing device-manufacturer security updates that include the fixes. The bulletin identifies affected chipsets by CVE rather than naming consumer device models.