MediaTek Modem CVE-2026-20519

Exploitation requires the victim UE to be attached to a rogue/malicious base station under attacker control (per the description), meaning the attacker must deploy a false cellular station and induce the device to connect over the air - this is the AV:A (Adjacent, radio proximity) and AC:H (high complexity) precondition. Once attached, no authentication (PR:N) and no user interaction (UI:N) are required; the malformed message triggers the out-of-bounds write directly in the modem. Limiting factors for defenders: the attack is not internet-remote and not automatable (SSVC Automatable=no), depends on physical radio proximity and successful device attachment to the rogue cell, and affects only devices running the listed MediaTek chipsets on unpatched modem firmware.

This is a genuine but conditional priority rather than a drop-everything emergency. The MediaTek-supplied CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.5 High) tells a consistent story: an adjacent (radio-proximity) attacker with no credentials and no user interaction can achieve total compromise of the modem, but only through a high-complexity precondition. All exploitation signals point AWAY from imminent mass exploitation: there is no CISA KEV listing, no public exploit identified at time of analysis, and the CISA SSVC decision framework explicitly scores Exploitation=none and Automatable=no. The one signal pulling the other way is SSVC Technical Impact=total, which agrees with the C:H/I:H/A:H impact and the CWE-787 out-of-bounds write leading to remote privilege escalation inside the modem. So the signals are internally consistent and NOT conflicting: high technical impact but low real-world exploitation likelihood because the attack is not automatable and requires physical radio proximity plus a rogue base station. One point to verify: the description phrases this as 'remote escalation of privilege,' yet the CVSS vector correctly uses AV:A (Adjacent), not AV:N - the 'remote' wording reflects over-the-air radio exploitation, not internet-routable access; defenders should treat this as a proximity attack, not a remotely scannable one.

An attacker stands up a rogue cellular base station (IMSI-catcher / false gNB-eNB) near target devices and induces a MediaTek-modem handset to attach to it. The rogue station sends a malformed over-the-air message that overflows a buffer lacking a bounds check in the modem firmware, writing out of bounds to escalate privileges within the baseband with no user interaction. No public exploit code has been identified at time of analysis, and the high attack complexity reflects the effort to deploy the rogue station and win the device attachment.