CVE-2026-20538: CWE-126 Buffer Over-read in MediaTek, Inc. MediaTek chipset

This vulnerability involves an out-of-bounds read in the modem of MediaTek chipsets due to a missing permission check. An attacker operating a rogue base station can exploit this flaw remotely to trigger a denial of service condition on connected devices. No user interaction or elevated privileges are necessary for exploitation. The issue is tracked as MSV-8914 and patched under Patch ID MOLY01774038.

Successful exploitation results in a remote denial of service on affected devices connected to a malicious base station. There is no indication of privilege escalation or data compromise from the provided information.

A patch identified as MOLY01774038 addresses this vulnerability. Users and vendors should apply this official fix to affected MediaTek chipsets. Since this is not a cloud service, remediation depends on device manufacturers integrating the patch into firmware updates. Patch status beyond the patch ID is not explicitly confirmed; check vendor advisories for current remediation guidance.