CVE-2025-20634 is a critical out of bounds write (CVSS 9.8) in the modem firmware of several MediaTek chipsets. A missing bounds check could allow remote code execution if a phone connects to a rogue base station. MediaTek lists patch ID MOLY01289384; install your device maker's firmware update.
What's affected
- Component: Modem firmware in MediaTek chipsets
- Chipsets named in the record include MT2737, MT6813, MT6835, MT6835T, MT6878, MT6878M, MT6879 and MT6886
- MediaTek patch ID: MOLY01289384, issue ID MSV-2436
- CVSS: 9.8 (Critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published: 2025-02-03, from MediaTek's February 2025 bulletin
MediaTek's own bulletin rates this issue High and describes it as remote code execution, while NVD scores it 9.8. Both are worth knowing. The record says user interaction is not needed and no additional execution privileges are required. The attacker would need the device to connect to a rogue base station that they control. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation.
The record does not list firmware versions per device. Chipset firmware reaches users through the phone, tablet or router maker, so the version that matters is the device's own security patch level.
How to check if you're exposed
You cannot update modem firmware directly, so the check is about the device.
- Identify the chipset. On Android, the device information screen or a hardware information app shows it. For a fleet, read it from your MDM inventory.
- Compare the device's security patch level with the maker's bulletin for February 2025 or later. Ask the maker which of their builds include MediaTek patch MOLY01289384.
- Read MediaTek's product security bulletin for February 2025 and match the chipsets in your estate against the list.
For managed devices, report on security patch level and filter for devices that have not taken updates since February 2025. A free in-browser dependency scan does not cover device firmware, so use device management for this one.
What to do now
- List the devices in your estate that use the chipsets named in MediaTek's bulletin.
- Ask each device maker which firmware or security patch level includes MediaTek patch MOLY01289384.
- Push or request those updates, and enforce a minimum patch level in your device management policy.
- For devices that no longer receive updates, plan replacement, and avoid using them for sensitive work in the meantime.
- Keep an eye on the bulletin for newer modem fixes, because modem bugs tend to come in groups.
Why it matters
The weakness is CWE-787, out of bounds write. Modem firmware parses data from the mobile network. A missing bounds check lets that data write past the end of a buffer, which can corrupt memory and change what the code does.
What makes this one notable is the reach. The code runs in the baseband, the processor that handles the radio, and the input arrives over the air from whatever base station the phone talks to. The record notes that no user interaction is needed. Defence depends almost entirely on update speed from the device makers, since customers cannot patch modem firmware themselves.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this exploited in the wild?
The CISA Known Exploited Vulnerabilities flag is false and the bulletin does not report exploitation.
Why do the bulletin and NVD give different severities?
MediaTek rates the issue High in its bulletin and NVD scores the vector at 9.8. Use the higher figure to set priority, and the patch ID to ask for the fix.
Sources
Last reviewed: 19 October 2026.
