MediaTek Modem CVE-2026-20461

Exploitation requires the target User Equipment (UE) - any mobile device containing one of the 33 listed MediaTek chipsets - to be physically connected (camped) to a rogue cellular base station under attacker control. The attacker must operate or control radio infrastructure capable of impersonating a legitimate cell tower with sufficient signal strength to cause the target device to preferentially attach to it. This is not a conventional internet-reachable attack; it requires radio-frequency proximity and cellular infrastructure expertise. No authentication is required at the modem protocol layer (PR:N per CVSS vector), and no user interaction or application-layer action by the victim is needed once the device attaches to the rogue cell. Exploitation is limited to the modem subsystem's availability - confidentiality and integrity of device data are not impacted. The non-default nature of the attack environment (rogue base station setup) materially limits opportunistic or automated exploitation despite PR:N and UI:N ratings.

The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures both the severity and the constraint: the High Attack Complexity reflects the real-world barrier of deploying or compromising a cellular base station, which requires significant resources and technical capability beyond a typical threat actor. Impact is limited strictly to availability (A:H) - a modem crash causes loss of cellular connectivity but there is no confirmed confidentiality or integrity impact. No CISA KEV listing exists, no public exploit or POC has been identified, and no EPSS data was provided, all of which are consistent with the AC:H constraint reducing opportunistic exploitation. The risk is most credible in targeted scenarios - nation-state actors, organized crime with radio infrastructure access, or IMSI-catcher operators. The absence of a scope change (S:U) confirms the impact is contained to the UE modem stack. Despite the moderate aggregate CVSS score, fleet-level risk is elevated because the 33 affected chipsets represent a very large share of mid-range to flagship Android devices globally; a single rogue base station could affect every reachable device simultaneously.

An attacker with access to software-defined radio (SDR) equipment and cellular infrastructure knowledge deploys a rogue LTE or 5G base station - a capability within reach of nation-state actors and some organized criminal groups - and broadcasts signals strong enough to force nearby devices to camp on the attacker-controlled cell. Once a target UE attaches to the rogue base station, the attacker transmits a crafted modem protocol message containing malformed data that triggers the missing bounds check, causing an out-of-bounds write in modem memory, crashing the modem stack and rendering the device unable to make or receive cellular calls or data until rebooted. No public exploit code has been identified, meaning exploitation currently requires independent vulnerability research and baseband development expertise.