CVE-2026-20461: Modem Out-of-Bounds Write Denial of Service

Technical summary

CVE-2026-20461 is an out-of-bounds write vulnerability (CWE-787) in modem firmware resulting from insufficient bounds validation. When a modem processes specially crafted network frames from an attacker-controlled base station, it writes beyond allocated buffer boundaries in memory. This memory corruption triggers a crash or denial of service on the affected mobile device. The attack vector is adjacent-network, meaning the attacker must be in RF range to operate the rogue base station. CVSS 3.1 score is 5.3 (Medium): AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting high availability impact but low complexity and no confidentiality or integrity consequences.

Business impact

Mobile device availability and user productivity are at risk. Affected users cannot maintain cellular connectivity or normal service until the device is rebooted or moved out of range of the rogue base station. For organizations with mobile workforces or those in densely populated areas with poor RF isolation, this creates a window for disruption. The impact is limited to denial of service; no data theft or system compromise occurs. Attackers might weaponize this tactically to disrupt critical operations in a localized area, but widespread deployment is impractical given RF range constraints.

Affected systems

The vulnerability affects modem implementations; specific device models and vendors are not detailed in public disclosures at this time. Organizations should consult vendor-specific security bulletins to identify which phones, tablets, or IoT modules are affected. Patch identifiers MOLY01267281 and MOLY01318201 are referenced in the fix, indicating the issue may span multiple firmware branches or product lines.

Exploitability

Exploitation requires the attacker to physically or RF-proximity position a rogue base station within range of the target device. The attacker then relies on a user (unknowingly) connecting to the malicious base station—there is no requiring user interaction in the sense of clicking a link, but physical proximity and user mobility into the attack zone is necessary. The technical exploit itself is low complexity once the rogue base station is established. This is not a remotely exploitable vulnerability in the traditional sense; it is network-adjacent and geographically bounded. Active exploitation in the wild is unlikely except in targeted, localized scenarios.

Remediation

Apply firmware patches MOLY01267281 or MOLY01318201 to affected modems as soon as they become available and are validated for your device models. Verify patch availability through your device manufacturer or mobile carrier. Until patched, users should avoid connecting to untrusted or open Wi-Fi networks and base stations; however, defense at the base station level is limited for end users. Network operators and device manufacturers should prioritize this update in regions or deployments where rogue base station attacks are a known concern.

Patch guidance

Contact your device manufacturer or mobile service provider to obtain and deploy the relevant firmware patch (MOLY01267281 or MOLY01318201). Verify the patch ID in the update notification or release notes before applying. Test patches in a controlled environment if possible, especially for critical devices. Prioritize patching devices in high-risk environments or those used by essential personnel. Check vendor advisories for any known compatibility issues or rollback procedures.

Detection guidance

Monitor for unexpected device crashes or sudden loss of cellular connectivity, particularly if clustered geographically or temporally. Network-based detection is limited because the attack occurs at the RF and modem firmware layer, below most security tools' visibility. Mobile device management (MDM) platforms should enforce automatic firmware updates and flag devices that remain unpatched. Consider RF monitoring or rogue base station detection tools if your organization operates in a high-threat environment. Incident response should correlate device crashes with base station logs or RF sensor data if available.

Why prioritize this

This vulnerability merits timely attention but not emergency response. The CVSS score of 5.3 (Medium) and absence from the CISA KEV catalog reflect the limited exploitability due to RF proximity requirements. However, availability impact is high, and affected organizations should plan patching within a standard maintenance window. Prioritize if you operate in regions known for sophisticated adversaries with RF capabilities or if your user base includes high-value targets.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects the combination of adjacent-network attack vector (lower risk than internet-facing), high complexity due to rogue base station setup requirements, no privilege escalation, and high impact on availability (device crash or loss of connectivity). Confidentiality and integrity scores are zero because the vulnerability does not expose data or allow unauthorized modifications. The moderate score appropriately captures that this is a localized, availability-focused threat without data exposure.

Frequently asked questions