Mediatek Chipset CVE-2026-20432

Attacker must operate a rogue cellular base station. Victim must connect their device (with affected modem) to this malicious base station. User interaction required: victim must establish connection. Affects devices running vulnerable modem firmware versions; default cellular configurations are vulnerable.

Real-world risk assessment reveals moderate-to-low practical exploitation likelihood despite the high CVSS base score of 8.0. The CVSS vector shows adjacent network requirement (AV:A) with user interaction needed (UI:R), creating significant operational barriers: attackers must deploy physical rogue base station equipment and convince users to connect to it, requiring sophisticated radio frequency capabilities and social engineering. The EPSS score of 0.06% at the 18th percentile aligns with these practical constraints, indicating security researchers assess actual exploitation probability as low. CISA SSVC framework classification of 'Exploitation: none' and 'Automatable: no' further supports this assessment, while 'Technical Impact: total' acknowledges the severity if successfully exploited. The requirement for user interaction to establish connection with rogue infrastructure significantly reduces attack scalability compared to remotely exploitable vulnerabilities. No KEV listing or public proof-of-concept exists, suggesting this remains theoretical threat rather than observed in-the-wild exploitation. Primary risk applies to high-value targets where nation-state actors might justify deploying IMSI catcher or rogue base station infrastructure, rather than opportunistic mass exploitation scenarios.

An attacker deploys a rogue cellular base station (IMSI catcher or similar equipment) configured to broadcast stronger signal than legitimate towers in a targeted location such as a corporate campus, government facility, or high-value individual's routine travel path. When the victim's device with vulnerable MediaTek chipset automatically or manually connects to this malicious base station, the attacker sends specially crafted cellular protocol messages designed to trigger the out-of-bounds write condition in the modem firmware. Successful exploitation overwrites critical memory regions in the modem subsystem, allowing the attacker to execute arbitrary code with modem processor privileges. From this position, the attacker can escalate to full device compromise, intercept communications, exfiltrate sensitive data, or maintain persistent access to the device. The attack requires physical proximity (radio range), specialized RF equipment, and user acceptance of the rogue network connection, making it most viable for targeted surveillance operations rather than mass exploitation campaigns.