CVE-2026-20525: CWE-617 Reachable Assertion in MediaTek, Inc. MediaTek chipset

This vulnerability (CWE-617: Reachable Assertion) exists in the modem of MediaTek chipsets due to improper input validation. An attacker operating a rogue base station can trigger a system crash remotely, resulting in a denial of service condition on the affected device. Exploitation does not require user interaction or elevated privileges. The issue is tracked under MediaTek's internal IDs MOLY01870473 / MOLY00814393 and MSV-9041. The affected chipsets include a broad range of MediaTek models such as MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, and MT8883.

Successful exploitation leads to a remote denial of service by causing the modem system to crash. This disrupts normal device operation but does not grant the attacker additional execution privileges or control over the device. No user interaction is required, increasing the risk of automated or stealthy attacks in environments where rogue base stations may be present.

A patch has been identified by MediaTek (Patch IDs MOLY01870473 / MOLY00814393), indicating that an official fix is available. Users and device manufacturers should apply the vendor's patch or firmware updates that include this fix. Since this is a chipset-level issue, remediation depends on device vendors integrating the patch into their firmware. No additional mitigation steps are specified in the available data.