MediaTek Modem CVE-2026-20449

Exploitation requires a device with an affected MediaTek chipset to connect to an attacker-controlled rogue base station; the target device must be in proximity (within radio range, typically 100 meters to several kilometers depending on base station equipment) of the rogue base station to receive the crafted wireless signal. The attack works against unmodified default configurations with cellular radios enabled (standard for all mobile devices and modems), requires no user interaction, and requires no authentication or special privileges on the target device. Limiting factors include: the attacker must have physical proximity and RF equipment capability to establish a credible base station (non-trivial barrier for most attackers); the device must actively search for or attempt to connect to cellular networks (attackers cannot force connection, but devices typically scan continuously); the attack results in denial of service only (crash and reboot), not code execution or data exfiltration; and patched devices running firmware with MOLY01760138 are protected from exploitation.

Risk assessment reveals a significant discrepancy between CVSS severity and real-world exploitation likelihood. The CVSS 6.5 score indicates medium severity driven by high availability impact (AH), but several factors substantially lower practical risk: the EPSS score of 0.07% (22nd percentile) indicates very low probability of exploitation in the wild; SSVC framework rates exploitation as 'none' (no evidence of active exploitation), automatable as 'no' (requires rogue base station setup), and technical impact as 'partial' (denial of service only, not code execution); the attack vector requires the attacker to physically position a rogue base station in range of the target device, making opportunistic mass exploitation infeasible. The vulnerability causes system crash (denial of service) rather than data breach or code execution, limiting impact scope. However, risk elevates for targeted scenarios: an attacker near a specific facility or with network positioning capability (mobile networks, corporate environments) could selectively crash devices, and the breadth of affected chipsets (70+ variants) means millions of devices may theoretically be vulnerable. The lack of KEV listing and absence of public exploit code suggest this remains a low-priority real-world threat despite medium CVSS scoring.

An attacker sets up a rogue cellular base station in a target area using software-defined radio equipment and cellular network simulation tools. When a mobile device with an affected MediaTek chipset attempts to connect to the rogue base station (appearing as a legitimate network), the attacker sends a specially crafted wireless signal containing a malformed message that triggers the heap buffer overflow in the modem's baseband processor. The overflow corrupts modem memory and causes a system crash, rendering the device unable to make or receive calls or use cellular data until the device is manually rebooted. No public proof-of-concept code has been identified.