This vulnerability (CVE-2026-20431) involves a logic error in the modem component of various MediaTek chipsets, leading to allocation of resources without limits or throttling (CWE-770). An attacker controlling a rogue base station can trigger a system crash remotely, causing denial of service on affected devices. Exploitation requires only that the UE connects to the malicious base station, with no user interaction or elevated privileges needed. The CVSS score is 6.5 (medium severity), reflecting the remote attack vector and high impact on availability. A patch is referenced by Patch ID MOLY01106496 and Issue ID MSV-4467, but no vendor advisory or confirmed remediation status is provided in the data.

Successful exploitation results in a remote denial of service condition, causing the affected device's modem to crash. This impacts availability but does not compromise confidentiality or integrity. No additional execution privileges or user interaction are required, increasing the risk of automated or stealthy attacks when connecting to rogue base stations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided data references a patch ID but does not confirm availability or deployment. Until an official fix is confirmed, avoid connecting to untrusted or unknown base stations to reduce exposure to this vulnerability.