This vulnerability (CVE-2026-20461) involves an out-of-bounds write (CWE-787) in the modem of MediaTek chipsets due to a missing bounds check. Exploitation requires the UE to connect to a malicious base station, enabling remote denial of service. No user interaction or elevated privileges are needed. The issue is identified by MediaTek with Patch IDs MOLY01267281 and MOLY01318201, but no explicit remediation level or patch availability is confirmed in the provided data. The affected chipsets include a broad range of MediaTek models such as MT2737, MT6813, MT6835, MT6858, MT6878, MT6879, MT6886, MT6895, MT6896, MT6897, MT6899, MT6980, MT6983, MT6985, MT6988, MT6989, MT6990, MT6991, MT6993, MT8673, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8796, MT8798, MT8863, MT8873, MT8883, and MT8893.

Successful exploitation leads to a remote denial of service condition on affected MediaTek chipsets' modem components. There is no impact on confidentiality or integrity, and no additional execution privileges are required. The attack vector is remote and requires the UE to connect to a rogue base station controlled by the attacker. User interaction is not necessary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has assigned patch IDs MOLY01267281 and MOLY01318201, which may correspond to fixes. Until official patches are confirmed and applied, avoid connecting devices to untrusted or rogue base stations where possible.