MediaTek’s November Product Security Bulletin fixes 57 vulnerabilities, six of them critical flaws in cellular modem firmware that allow remote privilege escalation. An attacker needs only radio contact with the target device, and the company says it knows of no exploitation.
Six Critical Modem Flaws From CVE-2026-20499 Through CVE-2026-20549
The six critical flaws are CVE-2026-20499, CVE-2026-20545, CVE-2026-20546, CVE-2026-20547, CVE-2026-20548 and CVE-2026-20549. All affect modem firmware, the component that handles cellular communication on MediaTek chipsets.
The causes span familiar memory-safety and input-handling errors: improper input validation, integer overflows and missing bounds checks. Each can be reached by a remote attacker who has radio contact with the target, so no click, download or credential is involved.
Radio Contact Is the Only Precondition for the MediaTek Modem Flaws
Most vulnerabilities require a user to open a file or visit a page. A modem flaw reachable over the radio interface removes that step. The attacker has to be within radio reach of the device, but the device owner does not need to take any action.
MediaTek Notified Device Makers Two Months Before the Bulletin
MediaTek told device makers about the flaws two months before it published the bulletin, which gives manufacturers time to prepare firmware. The company is not aware of any exploitation, and no public proof-of-concept exists.
Why OEM Firmware Updates Decide When MediaTek Fixes Reach Users
MediaTek does not ship patches directly to handset owners. Fixes reach users through firmware updates from the original equipment manufacturers that build devices around MediaTek chips. That makes the timing uneven: a phone maker that moves quickly can deliver the update soon, while others may take longer or skip older models.
MediaTek Chips Sit in an Estimated Two Billion Devices
An analyst estimate puts MediaTek chips in more than two billion devices. That figure is an estimate rather than a company statistic, but it indicates the potential population. Not every device uses a modem affected by the six critical flaws, and the available reporting does not list which chipsets are affected.
The combination of remote reach, no required user action and dependence on manufacturer updates is what distinguishes modem bugs from application flaws. Users have little to do beyond installing firmware updates when their manufacturer releases them, and administrators of mobile fleets will need to track OEM release notes rather than a single central patch channel.
The bulletin’s scope is broader than the six critical entries. Its 57 fixes cover the full range of MediaTek components, and the modem flaws stand out because they combine remote reach with privilege escalation. The causes named, improper input validation, integer overflows and missing bounds checks, are standard categories of memory-handling error in low-level firmware. MediaTek says it has seen no exploitation and that no proof-of-concept is public, so the current risk rests on the flaws’ characteristics rather than on observed attacks. Users who want to know whether their phone is covered will need to check their manufacturer’s security bulletin or update notes.
Two features set the modem flaws apart from ordinary operating-system bugs. First, the vulnerable code runs in the cellular baseband firmware, which processes data from the network before higher software layers see it. Second, the six critical flaws allow remote privilege escalation, meaning an attacker could gain a higher level of access than the radio interface normally grants. The bulletin does not describe a specific attack scenario, and MediaTek has not tied any of the flaws to a real-world campaign.
The two-month gap between OEM notification and publication is typical of coordinated disclosure, though the available reporting does not say how many device makers received the notice or how many have shipped fixes. The bulletin is the vendor’s statement of what is fixed; the schedule for each phone comes from its maker.
