CVE-2026-20540: CWE-126 Buffer Over-read in MediaTek, Inc. MediaTek chipset

This vulnerability involves a buffer over-read (CWE-126) in the modem of MediaTek chipsets due to a missing bounds check. An attacker operating a rogue base station can trigger this flaw remotely, leading to a denial of service condition on the user equipment (UE). Exploitation does not require user interaction or elevated privileges. The issue is tracked under Patch ID MOLY01774038 and Issue ID MSV-8912. Affected chipset models include a broad range of MediaTek MT series devices as explicitly listed.

Successful exploitation results in a remote denial of service on the affected device. There are no indications of privilege escalation or data compromise. The attack vector requires the UE to connect to a malicious base station controlled by the attacker. No user interaction is needed, increasing the risk in environments where rogue base stations may be present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance referencing Patch ID MOLY01774038 and Issue ID MSV-8912. Until an official fix is available, mitigating exposure to rogue base stations is recommended where possible.