CVE-2026-20421 is a security vulnerability classified as CWE-125 (out-of-bounds read) affecting multiple MediaTek modem chipsets, including MT2735, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, and MT8791. The flaw exists in the modem firmware (Modem NR15) where improper input validation allows an attacker controlling a rogue base station to send malformed inputs to the modem, triggering an out-of-bounds read. This leads to a system crash, effectively causing a remote denial of service (DoS) on the affected device. Exploitation does not require any user interaction or elevated privileges, making it easier for attackers to execute once a UE connects to a malicious base station. The vulnerability was reserved in November 2025 and published in February 2026, with no CVSS score assigned yet. MediaTek has issued a patch identified as MOLY01738293 to address this issue. Although no exploits are known in the wild, the vulnerability poses a significant risk to devices relying on these chipsets, especially in environments where rogue base stations can be deployed, such as public spaces or targeted attacks. The vulnerability impacts the availability of affected devices by causing crashes, potentially disrupting communications and services relying on these modems.

For European organizations, the primary impact of CVE-2026-20421 is the potential for remote denial of service on devices using affected MediaTek modem chipsets. This can disrupt mobile communications, impacting critical business operations, especially for sectors relying on mobile connectivity such as telecommunications providers, emergency services, and IoT deployments. The vulnerability could be exploited by attackers deploying rogue base stations in public or private areas to target specific users or groups, causing service outages without requiring user interaction or elevated privileges. This could lead to operational downtime, loss of connectivity, and potential cascading effects on dependent systems. Additionally, the presence of this vulnerability may undermine trust in mobile infrastructure security and complicate compliance with European cybersecurity regulations. While no data confidentiality or integrity compromise is indicated, the availability impact alone can be significant for organizations with high dependency on mobile networks.

1. Apply the official MediaTek patch MOLY01738293 as soon as it becomes available from device manufacturers or vendors to remediate the vulnerability in the modem firmware. 2. Network operators and enterprises should implement detection and mitigation mechanisms for rogue base stations, such as monitoring for suspicious base station identifiers and signal anomalies. 3. Employ network access control policies that restrict connections to trusted base stations where feasible. 4. For critical infrastructure, consider deploying multi-factor communication channels or fallback connectivity options to maintain service continuity in case of mobile network disruptions. 5. Encourage device manufacturers and service providers to update firmware promptly and communicate the importance of patching to end users. 6. Conduct regular security assessments of mobile network environments to identify potential attack vectors involving rogue base stations. 7. Educate users and administrators about the risks of connecting to untrusted networks and the signs of potential network manipulation.