Skip to content
Threat Feed
Subscribe
high advisory

Modem: Out-of-bounds write vulnerability (CVE-2026-20499)

A missing bounds check in Modem firmware allows an attacker operating a rogue base station to execute an out-of-bounds write, leading to remote privilege escalation without user interaction.

CVE search metadata

CVE search record: CVE-2026-20499. Severity: high. CVSS: 7.5. KEV: no. Product: Modem (Patch ID MOLY01857954), Modem (Patch ID: MOLY01876662), Modem. Brief: Modem: Out-of-bounds write vulnerability (CVE-2026-20499). Brief link: https://feed.craftedsignal.io/briefs/2026-11-modem-oob-write/

CVE search record: CVE-2026-20556. Severity: high. CVSS: 7.5. KEV: no. Product: Modem (Patch ID MOLY01857954), Modem (Patch ID: MOLY01876662), Modem. Brief: Modem: Out-of-bounds write vulnerability (CVE-2026-20499). Brief link: https://feed.craftedsignal.io/briefs/2026-11-modem-oob-write/

CVE search record: CVE-2026-20557. Severity: high. CVSS: 7.5. KEV: no. Product: Modem (Patch ID MOLY01857954), Modem (Patch ID: MOLY01876662), Modem. Brief: Modem: Out-of-bounds write vulnerability (CVE-2026-20499). Brief link: https://feed.craftedsignal.io/briefs/2026-11-modem-oob-write/

CVE search record: CVE-2026-20585. Severity: high. CVSS: 7.5. KEV: no. Product: Modem (Patch ID MOLY01857954), Modem (Patch ID: MOLY01876662), Modem. Brief: Modem: Out-of-bounds write vulnerability (CVE-2026-20499). Brief link: https://feed.craftedsignal.io/briefs/2026-11-modem-oob-write/

Triage facts

Revision 2
Applicability
Modem (Patch ID MOLY01857954), Modem (Patch ID: MOLY01876662) +1
Evidence
Unknown
Severity
High
Action
Elevated
Sources
4 public sources
Freshness
Revision 2Nov 2, 17:55 UTC
Vulnerabilities
4 CVEs
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    added CVE-2026-20585

    Changed: cves, lastmod, references, updates

    Sources: 1

CVE-2026-20499 is a memory corruption vulnerability in Modem firmware identified by the lack of bounds checking. The vulnerability allows for remote privilege escalation when a User Equipment (UE) device connects to a rogue base station controlled by an attacker. The vulnerability (MSV-8247) is addressed by Patch ID MOLY01857954.

Impact

An attacker can achieve remote privilege escalation on a target device without user interaction or prior elevated execution privileges by forcing the device to connect to a malicious base station.

Recommendation

  • Verify the current firmware version of all cellular-connected UEs in the environment.
  • Apply patch MOLY01857954 (Issue MSV-8247) to all affected Modem hardware.
  • Implement cellular network monitoring to identify anomalies in base station parameters or signal strength characteristics that may indicate rogue base station activity.

Immediate actions

Inventory mobile devices and verify firmware versions against vendor updates addressing CVE-2026-20556

IT Operations 72h

Threat Hunt

Monitor for anomalies in device connectivity, specifically unexpected handovers or base station changes that indicate potential rogue station interaction.

T1566 medium medium confidence monitor-only

Data: Device cellular connection logs, Base station tower ID changes

Detect unauthorized or unexpected base station handovers or unusual radio frequency behavior on corporate-issued mobile devices

T1068 medium medium confidence hunt now

Data: Mobile Threat Defense (MTD) logs, Base station connection telemetry

Mitigations

Apply firmware patch MOLY01857954 to all vulnerable Modem hardware.

immediate IT Operations

CVE-2026-20499

Apply firmware update MOLY01876662 to affected Modem components

immediate IT Operations

CVE-2026-20556