This vulnerability (CVE-2026-20458) affects various MediaTek chipset models and is caused by a missing bounds check in the modem, leading to a possible out-of-bounds write (CWE-787). The flaw can result in memory corruption and potentially enable remote escalation of privilege when a UE connects to a malicious base station. Exploitation requires no user interaction or elevated privileges. The issue is tracked under MediaTek's internal ID MSV-7298 and patch ID MOLY01402160, but no public patch or remediation details have been provided. The vulnerability is published and reserved as of mid-2025 but lacks a CVSS score or vendor advisory with patch status.

Successful exploitation could lead to remote escalation of privilege on affected MediaTek chipsets, potentially allowing an attacker controlling a rogue base station to compromise the modem's operation. This could impact device security and user privacy. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or mitigation instructions are publicly available. Users and administrators should monitor MediaTek advisories for updates and apply patches once released.