In Modem

CVE-2026-20458 is a classic CWE-787 out-of-bounds write in MediaTek's Modem (MOLY) firmware, triggered when the modem parses a malformed message from the serving cell. The flaw affects 53 chipsets spanning low-end feature-phone SoCs (MT6739) up through flagship Dimensity parts (MT6989, MT6991, MT8798) — essentially MediaTek's entire fielded lineup. MediaTek fixed the issue with internal patch MOLY01402160 (Issue MSV-7298) and shipped it to OEMs at least two months before the July 1, 2026 public disclosure.

MediaTek scored this HIGH (7.5, CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). That score is *directionally correct but overstated for enterprise fleet risk* — the AV:A adjacent-network vector is the honest part (attacker must be in RF range with a rogue base station), and AC:H reflects the real engineering effort of standing up a malicious eNB/gNB. For a fleet manager, the addressable population is not the datacenter — it's the corporate-issued handset and BYOD program. That reshapes the risk profile substantially.

Why this verdict

• Adjacent-network only: AV:A with a rogue-BTS prerequisite eliminates internet-scale exploitation. Every successful attack costs the adversary physical proximity — this is not going to be commodity malware.
• High attack complexity is real: AC:H reflects the genuine engineering lift — SDR + MOLY reverse-engineering per chipset variant. Cost floor sits at the state-actor / commercial-surveillance-vendor tier (NSO, Cytrox, Candiru class).
• Role multiplier — handset baseband: Blast radius on successful chain is *one device* → call/SMS/location intercept, potentially AP escape on unhardened builds. It is NOT identity, hypervisor, PAM, backup, CA, EDR, or edge appliance. No fleet floor triggers — MEDIUM ceiling is honest.
• Modem hardening trend: MediaTek MOLY has added stack cookies and W^X across recent releases, and Android 14+ pKVM isolates baseband from AP. Full chain (baseband RCE → AP takeover) is not free even after this primitive.
• Patch pipeline latency is the actual pain: OEM/carrier patching for baseband firmware historically runs 3–9 months behind MediaTek's OEM push. For an enterprise MDM fleet, tracking OEM patch level per device is the real work, not the exploit.

Why not higher?

HIGH would require either fleet-scale reach or a high-value role. AV:A + AC:H + rogue-BTS operational cost forecloses fleet scale; a handset modem is a personal-device role, not identity/edge/hypervisor. No KEV, no public PoC, no campaign attribution — nothing to justify a HIGH floor.

Why not lower?

LOW would ignore that the primitive is a pre-auth heap corruption on the modem with no user interaction (UI:N) and full CIA impact on the modem. This is exactly the class of bug used in past commercial-surveillance chains (Amnesty/Citizen Lab Predator/Pegasus disclosures), so for executive-protection or high-risk-user populations the risk is non-trivial. MEDIUM correctly reflects that.

1. Enforce OEM security patch level via MDM conditional access — In Intune/Jamf/Workspace ONE, set a conditional-access policy requiring Android security patch level ≥ 2026-07-05 (the July Android security bulletin merge point) for corporate resource access. This is MEDIUM verdict, so no mitigation SLA under the noisgate SLA — but staging the conditional-access rule within 60 days aligns with the 365-day remediation window and forces OEM/carrier patch pull-through.
2. Disable 2G on managed handsets — Android 14+ exposes a disable 2G toggle via DevicePolicyManager.setCellularTwoGDisabled. Push this via MDM. Most rogue-BTS attacks downgrade to 2G to bypass mutual auth — killing 2G raises the attacker's engineering bar and cost meaningfully.
3. Executive/high-risk-user program: rotate to lockdown-mode-capable devices — For board members, M&A staff, security research, and legal — devices with iOS Lockdown Mode or Samsung Knox equivalent, or non-MediaTek silicon, materially reduce baseband attack surface. Complete within 90 days for named high-risk-user list.
4. Inventory MediaTek-powered corporate handsets — Pull chipset field from your MDM (Intune ships hardware.SoC; Jamf exposes Hardware.Model). Cross-reference against the 53-chipset MediaTek list. You cannot prioritize what you cannot see.
5. Update Mobile Threat Defense signatures — Verify Lookout, Zimperium, or Wandera has telemetry for baseband anomalies and rogue-BTS heuristics. Coordinate with vendor for CVE-2026-20458-specific detection updates within 30 days.

Run this on a target Android handset via adb shell (USB debugging enabled, developer mode on). Invocation: adb shell sh /sdcard/check_cve_2026_20458.sh. No root required — reads only public getprop values. Reports VULNERABLE if the SoC is on the MediaTek list AND the Android security patch level is older than 2026-07-05.

#!/system/bin/sh
# noisgate verification: CVE-2026-20458 (MediaTek MOLY OOB write)
# Requires: adb shell access, no root
# Output: VULNERABLE / PATCHED / UNKNOWN

set -u

AFFECTED_SOCS="MT2716 MT2737 MT6739 MT6761 MT6762 MT6763 MT6765 MT6767 MT6768 MT6769 MT6771 MT6779 MT6781 MT6783 MT6785 MT6789 MT6813 MT6835 MT6858 MT6878 MT6879 MT6881 MT6886 MT6895 MT6896 MT6897 MT6899 MT6980 MT6982 MT6983 MT6985 MT6986 MT6988 MT6989 MT6990 MT6991 MT6993 MT8666 MT8667 MT8668 MT8673 MT8676 MT8678 MT8755 MT8765 MT8766 MT8768 MT8775 MT8781 MT8786 MT8788 MT8789 MT8792 MT8793 MT8796 MT8798 MT8863 MT8873 MT8883 MT8893"

FIX_PATCH_DATE="2026-07-05"

SOC=$(getprop ro.hardware 2>/dev/null; getprop ro.board.platform 2>/dev/null; getprop ro.soc.model 2>/dev/null)
PATCH=$(getprop ro.build.version.security_patch 2>/dev/null)
MANUFACTURER=$(getprop ro.product.manufacturer 2>/dev/null)
MODEL=$(getprop ro.product.model 2>/dev/null)

if [ -z "$SOC" ] || [ -z "$PATCH" ]; then
  echo "UNKNOWN: could not read SoC or patch level"
  exit 2
fi

echo "Manufacturer: $MANUFACTURER"
echo "Model:        $MODEL"
echo "SoC:          $SOC"
echo "Patch level:  $PATCH"

is_affected=0
for s in $AFFECTED_SOCS; do
  echo "$SOC" | grep -qi "$s" && is_affected=1 && break
done

if [ "$is_affected" -eq 0 ]; then
  echo "PATCHED: SoC not on MediaTek CVE-2026-20458 affected list"
  exit 0
fi

# Compare YYYY-MM-DD lexicographically
if [ "$PATCH" \< "$FIX_PATCH_DATE" ]; then
  echo "VULNERABLE: MediaTek SoC detected, patch level $PATCH < $FIX_PATCH_DATE"
  exit 1
else
  echo "PATCHED: MediaTek SoC detected, patch level $PATCH >= $FIX_PATCH_DATE"
  exit 0
fi

Sources

1. MediaTek Product Security Bulletin — July 2026
2. OffSeq Threat Radar — CVE-2026-20458
3. MITRE CWE-787: Out-of-bounds Write
4. Google Project Zero — Over the Air baseband research
5. Android — Disable 2G enterprise control
6. NCC Group — Baseband exploitation research
7. srsRAN Project — open-source RAN stack (attack tooling reference)
8. CISA Known Exploited Vulnerabilities Catalog