MediaTek Modem CVE-2026-20526

Exploitation requires the attacker to operate a rogue/malicious cellular base station within radio range (adjacent-network access) AND the victim's device must connect to that attacker-controlled base station; the description also states user interaction is needed, and exploitation is high-complexity (AC:H). Limiting factors: no internet/remote-over-IP vector, physical/RF proximity to the target, the setup and operation of a rogue base station, the victim UE associating with it, and the stated user-interaction requirement - together these constrain exploitation to targeted scenarios rather than opportunistic mass attacks. The flaw affects MediaTek baseband/modem firmware across the enumerated chipsets (e.g., MT6853, MT6980, MT6991, MT8798, MT6895); no authentication is required (PR:N).

This is a medium-to-high priority baseband flaw whose real-world risk is bounded by its access requirements rather than its CVSS score. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N) correctly captures that exploitation occurs over an adjacent radio link (not the open internet) and is of HIGH attack complexity because the attacker must stand up and operate a rogue base station that the victim UE then associates with - a non-trivial, proximity-dependent, targeted setup. There is a direct conflict in the input: the CVSS vector encodes UI:N (no user interaction), yet the description explicitly states 'User interaction is needed for exploitation' - this discrepancy should be verified with MediaTek, and my independent assessment uses UI:R accordingly. No EPSS score, no CISA KEV listing, and no public exploit were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the AC:H plus rogue-base-station prerequisite strongly indicates any exploitation would be targeted/proximity-based rather than widespread and automatable. Net: a genuine high-impact (C:H/I:H/A:H, remote privilege escalation in the modem) issue that warrants patching on the affected MediaTek chipsets, but not an internet-facing mass-exploitation emergency.

An attacker deploys a rogue/malicious cellular base station near a target and induces the victim's MediaTek-equipped device to attach to it. The rogue station sends a crafted modem message that overflows a buffer due to a missing bounds check (CWE-787), writing out of bounds in the baseband and escalating privilege within the modem. Exploitation is adjacent-network and high-complexity, requires the victim device to connect, and per the description needs user interaction; no public exploit code is identified at time of analysis.