New CVE records published on 2 November 2026, referencing MediaTek's November 2026 Product Security Bulletin, describe modem and network-stack flaws that phone and device makers need to pass on to users through firmware updates.

The first, CVE-2026-68588, is an integer overflow in the modem, classified as CWE-190. According to its CVE description, it could lead to remote denial of service if a user device has connected to a rogue base station controlled by an attacker. No additional execution privileges and no user interaction are needed for that scenario. Its patch identifiers are MOLY01334054 and MOLY01312486, under issue MSV-7920.

Two more flaws in the same bulletin

CVE-2026-68590 affects ip_stack, where improper input validation could cause an out-of-bounds read, classified as CWE-125. It carries the same remote denial-of-service scenario: a device connected to a rogue base station, with no additional privileges and no user interaction required. Its patch identifier is MOLY01387180, under issue MSV-5152.

CVE-2026-68589 is different in kind. It is an out-of-bounds write in the modem, classified as CWE-787, caused by a missing bounds check. It could lead to local escalation of privilege, but only if a malicious actor has already obtained System privilege. No user interaction is needed. Its patch identifier is MOLY01320076, under issue MSV-6889.

What users and makers should do

For ordinary users, the practical step is unglamorous: install firmware and security updates from the device maker when they arrive, since a chipset fix only reaches a handset through that maker's update. For device makers and operators, the rogue-base-station condition in two of the three records is the detail to note, because it frames the risk around untrusted network connections rather than a malicious app or a link the user must click.

Sources

MediaTek: Product Security Bulletin, November 2026
CVE record: CVE-2026-68588