Mediatek Chipset CVE-2026-20431

The CVSS 6.5 score reflects a moderate vulnerability with high availability impact and low attack complexity, but multiple risk signals indicate lower real-world priority. The EPSS score of 0.08% (24th percentile) indicates very low probability of exploitation in the wild, significantly below the median for published CVEs. CISA SSVC framework corroborates this assessment: exploitation status is 'none' (no active exploitation observed), the attack is not automatable (requires sophisticated base station simulation), and technical impact is partial (denial of service only, no confidentiality or integrity breach). The attack vector of AV:A (adjacent network) further constrains practical exploitation-the attacker must be in radio range and must operate a rogue base station, substantially reducing real-world threat likelihood compared to remote network attacks. This discrepancy between CVSS severity and actual exploitation probability represents a case where numeric severity scores overstate practical risk.

An attacker with knowledge of LTE/5G radio protocols sets up a rogue base station in a populated area and broadcasts crafted radio signals designed to trigger the logic error in vulnerable MediaTek modem firmware. When a target device connects to the rogue base station, the modem attempts to process the malicious signals, triggering uncontrolled resource allocation that exhausts heap memory or causes a firmware panic, resulting in the modem crashing and the device becoming unable to establish cellular connectivity. The attack requires physical proximity to the target and sophisticated base station simulation capability, making it impractical for widespread exploitation.