MediaTek Modem Chipset CVE-2026-20450

The attacker must control a rogue base station (femtocell, picocell, or software-defined radio simulator) capable of transmitting cellular protocol frames within RF range of the target device. The target device must have an affected MediaTek chipset and must have modem power enabled (standard default configuration). The malformed RAN message triggering the assertion must match specific MediaTek modem firmware versions; the exact message structure is not disclosed in available sources. No authentication, user interaction, or special device configuration is required beyond the device being in active cellular standby or connected mode. This limits exploitation to adversaries with RF equipment expertise and physical or RF proximity to targets, not to remote internet-based attack.

This is a limited-scope denial of service with moderate real-world risk despite CVSS 6.5 severity. EPSS score of 0.08% (23rd percentile) indicates low exploitation probability in the wild, contradicting the higher CVSS score - a common pattern for adjacent-vector vulnerabilities that require specific environmental conditions. SSVC decision framework (Exploitation: none, Automatable: no, Technical Impact: partial) reinforces that this is not a priority emergency, as exploitation requires sophisticated radio frequency equipment to simulate a base station and the impact is modem crash rather than code execution. No public exploit code or KEV listing in input indicates no confirmed active exploitation. However, the vulnerability affects 47+ MediaTek chipset variants across diverse device classes, meaning patch deployment scale is massive. The low EPSS score suggests attackers have not invested in weaponization, possibly because the attack requires specialized knowledge of cellular protocols and RF equipment. Risk is highest for critical infrastructure (cellular carriers, mission-critical IoT) operating in adversary-controlled RF environments; consumer mobile devices in normal network conditions face minimal practical risk.

An attacker deploys a rogue 4G/5G base station (femtocell or software-defined radio) in a target area and broadcasts crafted RAN protocol messages with malformed error handling sequences. When a nearby mobile device or IoT device with an affected MediaTek chipset connects to the rogue station, the modem firmware's assertion check fails on the crafted message, causing an unhandled exception that crashes the modem firmware. The device loses cellular connectivity for 10-30 seconds while the modem restarts and reconnects to a legitimate network, causing denial of service to time-sensitive applications.