Sign-up

ID

VAR-202602-0284


CVE

CVE-2026-20420


TITLE

media tech's NR15 Vulnerabilities related to out-of-bounds reading in multiple products, including

Trust: 0.8

sources: JVNDB: JVNDB-2026-002648

DESCRIPTION

In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01738313; Issue ID: MSV-5935. Improper error handling in modems can lead to system crashes, which can expose malicious base stations controlled by attackers. UE connects, it can allow a remote denial of service ( DoS ) may occur. Patch ID teeth MOLY01738313 ,problem ID teeth MSV-5935 is.Information handled by the software will not be leaked to the outside. Information handled by the software will not be rewritten. In addition, the software may stop functioning completely. Furthermore, attacks that exploit this vulnerability will not affect other software

Trust: 1.62

sources: NVD: CVE-2026-20420 // JVNDB: JVNDB-2026-002648

AFFECTED PRODUCTS

vendor:mediatekmodel:nr16scope:eqversion: -

Trust: 1.0

vendor:mediatekmodel:nr17rscope:eqversion: -

Trust: 1.0

vendor:mediatekmodel:nr15scope:eqversion: -

Trust: 1.0

vendor:mediatekmodel:nr17scope:eqversion: -

Trust: 1.0

vendor:メディアテックmodel:nr17rscope: - version: -

Trust: 0.8

vendor:メディアテックmodel:nr17scope: - version: -

Trust: 0.8

vendor:メディアテックmodel:nr16scope: - version: -

Trust: 0.8

vendor:メディアテックmodel:nr15scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2026-002648 // NVD: CVE-2026-20420

CVSS

SEVERITY

CVSSV2

CVSSV3

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2026-20420
value: HIGH

Trust: 1.0

OTHER: JVNDB-2026-002648
value: HIGH

Trust: 0.8

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2026-20420
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

OTHER: JVNDB-2026-002648
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2026-002648 // NVD: CVE-2026-20420

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.0

problemtype:Out-of-bounds read (CWE-125) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2026-002648 // NVD: CVE-2026-20420

PATCH

title:February 2026url:https://corp.mediatek.com/product-security-bulletin/February-2026

Trust: 0.8

sources: JVNDB: JVNDB-2026-002648

EXTERNAL IDS

db:NVDid:CVE-2026-20420

Trust: 2.6

db:JVNDBid:JVNDB-2026-002648

Trust: 0.8

sources: JVNDB: JVNDB-2026-002648 // NVD: CVE-2026-20420

REFERENCES

url:https://corp.mediatek.com/product-security-bulletin/february-2026

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2026-20420

Trust: 0.8

sources: JVNDB: JVNDB-2026-002648 // NVD: CVE-2026-20420

SOURCES

db:JVNDBid:JVNDB-2026-002648
db:NVDid:CVE-2026-20420

LAST UPDATE DATE

2026-02-12T23:40:23.083000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2026-002648date:2026-02-05T06:44:00
db:NVDid:CVE-2026-20420date:2026-02-03T21:25:41.460

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2026-002648date:2026-02-05T00:00:00
db:NVDid:CVE-2026-20420date:2026-02-02T09:15:57.123