CVE-2026-20461: Modem Out of Bounds Write DoS Vulnerability

CVE-2026-20461 Overview

CVE-2026-20461 is an out-of-bounds write vulnerability in MediaTek Modem firmware. The flaw stems from a missing bounds check in modem baseband processing code [CWE-787]. An attacker operating a rogue base station can trigger the condition when a User Equipment (UE) connects to the malicious cell. Successful exploitation results in remote denial of service on the affected device. The attack requires no user interaction and no authentication. MediaTek addressed the issue in patches MOLY01267281 and MOLY01318201, tracked internally as Issue ID MSV-6486. The vulnerability affects device availability but does not permit code execution or data disclosure.

Critical Impact
Attackers controlling a rogue base station can remotely crash the modem of any connecting device, disrupting cellular connectivity without user interaction.

Affected Products

MediaTek Modem (baseband firmware)
Devices integrating MediaTek chipsets with vulnerable modem firmware
See the MediaTek Security Bulletin July 2026 for the full chipset list

Discovery Timeline

2026-07-01 - CVE-2026-20461 published to NVD
2026-07-01 - MediaTek publishes Security Bulletin for July 2026
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-20461

Vulnerability Analysis

The vulnerability resides in the MediaTek modem firmware component responsible for processing signaling messages received over the cellular air interface. The code path handling attacker-controlled protocol data fails to validate input length before writing to a fixed-size buffer. This missing bounds check permits writes past the end of the destination buffer, corrupting adjacent memory in the modem's runtime state. The resulting corruption causes the modem subsystem to crash, terminating cellular data and voice services on the affected User Equipment (UE) until the modem is restarted.

The issue is classified under Common Weakness Enumeration [CWE-787] (Out-of-bounds Write). Exploitation impacts availability only; confidentiality and integrity are not affected because the corrupted process does not leak data or continue execution under attacker control.

Root Cause

The root cause is the absence of a length or boundary validation check on protocol fields parsed by the modem before those fields are copied into a stack or heap buffer. When an attacker crafts a signaling message with a field larger than the buffer expects, the copy operation writes past the buffer boundary. MediaTek's fix, delivered in patches MOLY01267281 and MOLY01318201, introduces the missing validation logic.

Attack Vector

The attack requires physical proximity within radio range of the target device. An attacker deploys a rogue base station configured to advertise a network the UE will attempt to attach to. Once the UE initiates the connection, the attacker sends a malformed signaling message that triggers the out-of-bounds write in the modem. No user interaction is required and no credentials are needed. The attack surface is limited to adjacent radio access rather than the broader internet, which reduces reach but not effectiveness against targeted individuals in a physical location.

No public proof-of-concept code has been released. Technical details are described in prose only; see the MediaTek Security Bulletin July 2026 for vendor guidance.

Detection Methods for CVE-2026-20461

Indicators of Compromise

Unexpected modem crashes, reboots, or loss of cellular service on MediaTek-based devices in a specific physical area
Device logs showing modem subsystem restarts (ssr events) or MOLY firmware exceptions
Presence of unauthorized or unknown cell towers in cellular scan data reported by devices

Detection Strategies

Monitor mobile device management (MDM) telemetry for spikes in modem crash reports or SSR (Subsystem Restart) events on MediaTek devices
Deploy IMSI-catcher and rogue base station detection tooling in sensitive physical locations to flag unauthorized cells
Correlate device connectivity loss incidents by geographic location to identify potential rogue base station activity

Monitoring Recommendations

Enroll MediaTek-based devices into MDM platforms that report firmware version and patch level, tracking MOLY build strings
Alert on repeated loss-of-service events reported by mobile endpoints in short time windows
Track cellular attach failures and unusual Public Land Mobile Network (PLMN) IDs observed by fleet devices

How to Mitigate CVE-2026-20461

Immediate Actions Required

Apply the MediaTek July 2026 security bulletin patches (MOLY01267281 and MOLY01318201) as soon as OEM updates are available
Contact device manufacturers (OEMs) to confirm the timeline for integrating the MediaTek modem fix into their firmware releases
Inventory MediaTek-based devices in your fleet and prioritize patching for personnel operating in higher-risk physical environments

Patch Information

MediaTek published fixes in the MediaTek Security Bulletin July 2026. The relevant Patch IDs are MOLY01267281 and MOLY01318201, tracked as Issue ID MSV-6486. Fixes reach end users through OEM device firmware updates rather than direct MediaTek distribution. Verify patch adoption by checking the device modem firmware build string after updates are installed.

Workarounds

Where feasible, restrict devices to trusted Wi-Fi networks and disable cellular radios in high-risk locations until patched firmware is available
Configure devices to prefer known operator networks and disable automatic attachment to unknown or lower-priority networks where the operating system permits
Use hardware or software that detects rogue base stations and alerts users when suspicious cells appear

bash

# Verify MediaTek modem firmware build on Android via adb
adb shell getprop | grep -i "gsm.version.baseband\|ril.modem"