This vulnerability (CVE-2026-20433) involves an out-of-bounds write (CWE-787) in the modem of MediaTek chipsets due to a missing bounds check. An attacker controlling a rogue base station could exploit this flaw when a user equipment (UE) connects to it, potentially escalating privileges remotely. Exploitation requires user interaction but no additional execution privileges. The issue affects numerous MediaTek chipset versions. There is no CVSS score or vendor advisory indicating patch availability or remediation status at this time.

If exploited, this vulnerability could allow an attacker to remotely escalate privileges on the affected device by leveraging a rogue base station connection. This could compromise device security and potentially allow unauthorized control or access. However, exploitation requires user interaction and connection to a malicious base station. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users and administrators should monitor MediaTek advisories for updates. Until a fix is available, avoid connecting to untrusted or suspicious base stations and exercise caution with user interactions that could trigger the vulnerability.