In Modem

CVE-2026-20461 is an out-of-bounds write (CWE-787) in the MediaTek modem firmware caused by a missing bounds check in a packet parser. An attacker who stands up a rogue base station the target device attaches to can craft a message that overruns a modem-side buffer. MediaTek describes the impact as remote denial of service, with no user interaction and no elevated privileges required. The affected list is huge — 33 SoCs including MT6895/6897/6899, MT6989/6991/6993, MT8676/8678, MT8798, MT8893 and more — covering flagship 5G smartphones, tablets, Chromebooks, and connected-car/IoT modules shipped from ~2022 onward. Patch IDs are MOLY01267281 / MOLY01318201, delivered to OEMs at least 60 days before disclosure and rolling into the July 2026 Android Security Bulletin dependent-patch cycle.

MediaTek labels this HIGH. That rating reflects the modem's ring-0-equivalent position on the baseband, not the actual demonstrated impact. The advisory is explicit: the outcome is DoS, not RCE, not code execution in the AP kernel, not SIM/IMSI theft. Baseband OOB writes *can* escalate to code execution, but MediaTek does not claim that here and no public PoC demonstrates it. Weighed against the operational reality — attacker must stand up an SDR + fake gNodeB within RF range, victims lose service until the modem resets — this is a MEDIUM. It becomes interesting only in targeted-surveillance scenarios where a rogue BTS is already the operating model.

Why this verdict

• Impact ceiling is DoS: vendor advisory is explicit — no confidentiality, no integrity, no persistence, no AP-side compromise. A modem crash equals lost signal until reboot.
• Attack vector is RF-adjacent, not remote-internet: requires a rogue gNodeB within RF range. This eliminates opportunistic mass exploitation and confines threat to targeted operations (nation-state, journalist/dissident targeting).
• No public PoC, no in-the-wild use, not KEV: internal MediaTek find, disclosed today, zero exploitation telemetry, EPSS effectively baseline.
• Role multiplier — smartphone/tablet endpoint: The chain succeeds in the *typical* role (employee handset, tablet, Chromebook), blast radius is loss of cell service on one device. No lateral movement, no fleet effect.
• Role multiplier — connected vehicle / IoT modem (MT2737, MT8755, MT8863 telematics): If exploited against a vehicle TCU during operation, DoS on cellular could disable emergency call / OTA / fleet-management uplink. Blast radius stays scoped to that vehicle; no supply-chain or fleet pivot. Not a floor-raising role because population is small and impact is still availability-only.
• Role multiplier — no canonical high-value role: MediaTek modems do not host IdP, PKI, hypervisor, backup, or kernel-mode security agent functions. No HIGH/CRITICAL floor triggers.
• Friction stack: illegal RF broadcast + physical presence + baseband RE + 33-SoC parser variance. Every layer prices out commodity attackers.

Why not higher?

HIGH would require either a plausible path to baseband code execution (MediaTek does not claim it, no PoC demonstrates it) or a widely-exploitable network vector (this needs a rogue base station, not the public internet). Vendor's own HIGH label conflates the modem's privileged position with actual demonstrated impact — for enterprise defenders managing 10,000 hosts, transient cellular DoS on a subset of Android/Chromebook devices does not warrant HIGH triage.

Why not lower?

LOW would undersell the fact that the affected SoC list is enormous — Dimensity 9000/8000-class flagships ship in tens of millions of devices — and the attack requires zero user interaction. Targeted-surveillance actors with rogue-BTS capability (already-established TTPs: Stingray, Hailstorm, criminal IMSI-catcher gray market) can weaponize DoS as a coercion tool. MEDIUM is right; below MEDIUM ignores the non-zero targeted risk.

1. Ship the July 2026 OEM patch level via MDM policy — Intune / Jamf / Workspace ONE / Kandji: set minimum Android security patch level to 2026-07-01 (or the earliest OEM level that includes MOLY01267281 / MOLY01318201) with a 365-day noise-free remediation window per the noisgate MEDIUM SLA. Non-compliant devices should lose access to sensitive apps via Conditional Access.
2. Enforce 5G SA-only on high-risk personas — For execs, legal, M&A, and threat-model-relevant staff, push a carrier profile / APN config that disables 2G and prefers 5G SA. This blocks the classic downgrade-to-legacy attach path that many IMSI-catchers rely on. On Android 14+ use the Cellular Security settings toggle 'Require 5G'.
3. Deploy Mobile Threat Defense (Zimperium zIPS, Lookout MES, Wandera) to high-risk fleets — MTD agents flag suspicious cell behavior (rapid signal changes, unknown PLMN attach, baseband reset patterns). Not perfect but the only signal enterprises get for rogue-BTS activity. Deploy alongside patch rollout within the same 365-day MEDIUM window.
4. Add rogue-BTS awareness to executive protection briefings — For travel to high-surveillance jurisdictions, brief on Wi-Fi-first mode, avoiding unknown cell hand-offs, using eSIM burners. Especially relevant if you also have unpatched Qualcomm/MediaTek baseband issues stacking.

Run on an Intune-connected auditor workstation with Microsoft.Graph.DeviceManagement module and Global Reader / Intune Reader rights. Invoke as .\Check-CVE-2026-20461.ps1 -MinPatchLevel '2026-07-01'. This inventories Android/Chromebook devices, flags those with MediaTek SoCs below the July 2026 patch level, and outputs VULNERABLE / PATCHED / UNKNOWN per device. Requires no credentials on the endpoint itself — everything reads through Graph.

#Requires -Modules Microsoft.Graph.DeviceManagement
<#
.SYNOPSIS
  Audit Intune-managed Android/Chromebook devices for CVE-2026-20461
  (MediaTek modem OOB write, patched in July 2026 OEM patch level).
.PARAMETER MinPatchLevel
  Minimum acceptable Android security patch level, format YYYY-MM-DD.
#>
param(
    [Parameter(Mandatory=$true)][string]$MinPatchLevel
)

$ErrorActionPreference = 'Stop'

# Affected MediaTek SoC families (substrings that appear in device hardware fields)
$AffectedSoCs = @(
    'MT2737','MT6813','MT6835','MT6858','MT6878','MT6879','MT6886',
    'MT6895','MT6896','MT6897','MT6899','MT6980','MT6983','MT6985',
    'MT6988','MT6989','MT6990','MT6991','MT6993','MT8673','MT8676',
    'MT8678','MT8755','MT8775','MT8792','MT8793','MT8795T','MT8796',
    'MT8798','MT8863','MT8873','MT8883','MT8893',
    'Dimensity','Kompanio','Genio'
)

try {
    Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All' -NoWelcome
} catch {
    Write-Error "Graph auth failed: $_"
    exit 2
}

$minDate = [datetime]::ParseExact($MinPatchLevel,'yyyy-MM-dd',$null)
$devices = Get-MgDeviceManagementManagedDevice -All -Filter "operatingSystem eq 'Android' or operatingSystem eq 'ChromeOS'"

$results = foreach ($d in $devices) {
    $soc = "$($d.Manufacturer) $($d.Model) $($d.HardwareInformation.Product)"
    $isAffectedSoC = $AffectedSoCs | Where-Object { $soc -match $_ }
    $status = 'UNKNOWN'

    if (-not $isAffectedSoC) {
        $status = 'PATCHED'  # not an affected SoC family
    } else {
        $patchStr = $d.AndroidSecurityPatchLevel
        if ($patchStr) {
            try {
                $patchDate = [datetime]::ParseExact($patchStr,'yyyy-MM-dd',$null)
                if ($patchDate -ge $minDate) { $status = 'PATCHED' }
                else { $status = 'VULNERABLE' }
            } catch { $status = 'UNKNOWN' }
        }
    }

    [pscustomobject]@{
        DeviceName    = $d.DeviceName
        User          = $d.UserPrincipalName
        OS            = $d.OperatingSystem
        SoCHint       = $soc.Trim()
        PatchLevel    = $d.AndroidSecurityPatchLevel
        Status        = $status
    }
}

$results | Sort-Object Status,DeviceName | Format-Table -AutoSize
$vulnCount = ($results | Where-Object Status -eq 'VULNERABLE').Count
Write-Host ""
Write-Host "VULNERABLE: $vulnCount" -ForegroundColor Red
Write-Host "PATCHED   : $(($results | Where-Object Status -eq 'PATCHED').Count)" -ForegroundColor Green
Write-Host "UNKNOWN   : $(($results | Where-Object Status -eq 'UNKNOWN').Count)" -ForegroundColor Yellow

if ($vulnCount -gt 0) { exit 1 } else { exit 0 }

Sources

1. MediaTek July 2026 Product Security Bulletin
2. OffSeq Threat Radar — CVE-2026-20461
3. CWE-787: Out-of-bounds Write
4. Android Security Bulletin — July 2026
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS Model
7. srsRAN / rogue base station research context
8. Comsecuris baseband research (background reading on modem RCE feasibility)