CVE-2026-20503: CWE-617 Reachable Assertion in MediaTek, Inc. MediaTek chipset

The vulnerability identified as CVE-2026-20503 affects multiple MediaTek chipset models. It is a reachable assertion issue (CWE-617) in the modem subsystem due to a missing bounds check, which can cause a system crash. An attacker controlling a rogue base station can exploit this remotely to cause a denial of service on the affected device without needing additional privileges or user interaction. The issue is tracked internally by MediaTek as MSV-9020 with patch ID MOLY01371002, but no public patch or remediation details are provided in the available data.

Successful exploitation results in a remote denial of service condition causing the affected device to crash. This impacts device availability but does not indicate privilege escalation or data compromise. The attack vector requires the device to connect to a malicious base station, which may limit exposure to targeted scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been publicly disclosed. Until a patch is available, limiting exposure to rogue base stations may reduce risk.