MediaTek Modem CVE-2026-20520

Exploitation requires the victim's UE (device modem) to connect to a rogue base station controlled by the attacker - i.e., the attacker must operate malicious cellular radio infrastructure within signal range and get the target device to attach to it. This is reflected by AV:A (adjacent/radio proximity) and AC:H (the setup and victim-attachment conditions raise complexity). Limiting factors: physical/radio proximity is mandatory (not remotely exploitable over the internet), and the attack cannot be automated at scale (SSVC Automatable: no). No authentication is required (PR:N) and no user interaction is needed (UI:N), and it affects the listed MediaTek chipsets regardless of configuration, so the only real gating conditions are proximity and the rogue-base-station prerequisite. Patch MOLY01778988 (Issue MSV-8897) remediates it.

This is a genuine but conditionally-gated mobile baseband vulnerability rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 7.5) requires no privileges or user interaction and yields total CIA compromise, but two signals temper real-world risk: AV:A (adjacent, not network) means the attacker must be within radio range operating a rogue base station, and AC:H reflects the non-trivial setup and timing conditions. These CVSS facts align cleanly with CISA SSVC, which rates Exploitation as 'none' (no observed or reported exploitation) and Automatable as 'no' (the rogue-base-station prerequisite cannot be mass-scripted across the internet), while confirming Technical Impact as 'total' - consistent with the C:H/I:H/A:H and the CWE-787 out-of-bounds write. There is no CISA KEV listing and no EPSS score or public POC in the provided data, so exploitation is currently theoretical. The signals are consistent with one another (high technical impact but low ease/breadth of exploitation), pointing to a targeted, proximity-based threat (e.g., against high-value individuals) rather than widespread opportunistic attack. One point to verify with the vendor: an out-of-bounds write in the modem leading to 'escalation of privilege' could plausibly cross a trust boundary from baseband into the application processor, which would arguably warrant S:C (scope change); MediaTek rated it S:U, so the scope impact should be confirmed.

An attacker sets up a rogue/malicious base station (e.g., a fake cell tower) within radio range and induces a nearby MediaTek-powered device's modem to connect. Once the UE attaches, the attacker sends a crafted over-the-air message that triggers the missing bounds check, causing an out-of-bounds write in modem memory and escalating privileges on the baseband with no user interaction. No public exploit code has been identified at time of analysis, and the high attack complexity (rogue base station plus victim attachment) makes this a targeted rather than opportunistic scenario.