MediaTek November 2026 bulletin: six critical modem fixes, wait for your phone's update

Chipmakers publish security bulletins. Your phone brand ships the update you can actually install. On November 2, 2026, MediaTek posted its November 2026 Product Security Bulletin with 56 CVEs, including six Critical modem issues. If your Android phone or tablet uses a MediaTek chip, as many budget and midrange models do, this is your cue to watch for a manufacturer firmware update and then prove it landed.

This is not the same story as SMS of Death / CVE-2026-58882 (a telephony software crash path) or Samsung’s October SMR note. MediaTek’s page is about firmware flaws inside MediaTek components. The fixes still reach you through your phone maker’s system updates.

What MediaTek published on November 2

From MediaTek’s own bulletin:

• Device makers were notified of the issues and patches at least two months before public release.
• MediaTek says it is not aware of active exploitation in the wild at publication time.
• Severity uses CVSS v3.1.

Critical (modem, out-of-bounds write class issues):

• CVE-2026-20499
• CVE-2026-20545
• CVE-2026-20546
• CVE-2026-20547
• CVE-2026-20548
• CVE-2026-20549

MediaTek’s short descriptions point at missing or incorrect bounds checks, an integer overflow, and improper input validation in modem code. MediaTek does not describe how an attack would work. SecurityOnline says an attacker running a fake cell tower could send malformed signals to trigger the bug without any tap. You do not need the technical details. You need your phone maker’s update that includes these fixes.

The same bulletin lists 16 High issues (most in the modem, plus GPS and other components) and 34 Medium issues (modem, audio, USB, and others). The six Critical ones matter most.

Each Critical CVE affects dozens of MediaTek chips, listed by MT model number. Most people do not know which chip is in their phone, and you do not need to. If your phone still gets security updates, install them and check the date afterward.

Why you cannot download a MediaTek patch directly

MediaTek sends fixes to phone makers, who build them into a system update for your model, region, and sometimes carrier. There is no safe MediaTek download for you to install yourself.

So the steps are simple:

1. Watch Settings > System update (or your brand’s Software update screen).
2. Install the next security or combined OS update when it appears.
3. Confirm the Android security patch level date moved forward.
4. If your phone maker’s release notes mention MediaTek or modem fixes, that confirms the update covers this bulletin.

Samsung also lists its monthly fixes separately (see our October SMR note). Recent Pixel phones use Google’s Tensor chips, not MediaTek, so this bulletin is less likely to apply to them. If you are unsure which silicon is inside the handset, the update habit is still correct: install vendor security updates promptly.

How to update and verify at home

1. Connect to Wi-Fi and plug in, or make sure the battery is well charged.
2. Open Settings > System update / Software update > Download and install.
3. Install, restart, and give the phone a few minutes to finish.
4. Open Settings > About phone and read:
   • Android version
   • Android security update / security patch level date
   • On Samsung, also the security software version string when shown
5. If a new update was supposed to include November MediaTek fixes and the security patch level did not move, the package may not be on your model yet. Check again later. A factory reset will not bring the update sooner.

Also keep Google Play system updates current when offered. They update some parts of Android, but they do not replace your phone maker’s modem fixes.

Do this / don’t do that

Do

• Install your phone maker’s system updates as they arrive in the coming weeks.
• Confirm the security patch level date yourself after every update.
• Retire phones that no longer receive monthly security builds. A phone that still works fine can still have unfixed Critical flaws.

Don’t

• Do not install unofficial MediaTek firmware from the web.
• Do not assume a big feature update included these modem fixes. Check the security patch date.
• Do not worry about matching chip numbers on MediaTek’s tables. Installing updates is what protects you.
• Do not confuse this with the SMS of Death telephony crash story. It is a different bug, though the advice is the same: update your phone.

Bottom line

MediaTek’s November 2, 2026 bulletin (official page) lists fixes for six Critical modem CVEs (CVE-2026-20499, CVE-2026-20545 through CVE-2026-20549) plus 16 High and 34 Medium issues, with no claimed in-the-wild exploitation at publication. You cannot install MediaTek’s fixes directly. Watch your phone brand’s system update, install it, restart, and confirm the security patch level moved.

Image: Official MediaTek “M” brand art from mediatek.com.