CVE-2026-20520

Executive Summary

CVE-2026-20520 is an out-of-bounds write vulnerability (CWE-787) in an unspecified modem component, arising from a missing bounds check on attacker-influenced input. The flaw is exploitable by an attacker operating a rogue base station: a User Equipment (UE) that connects to the malicious base station can be triggered into memory corruption leading to remote escalation of privilege, with no user interaction and no additional execution privileges required. Because the defect resides in baseband/modem firmware rather than the application processor, exploitation occurs below the operating system's security boundary, making it difficult to detect, patch, and contain.

Technical Analysis

The NVD description states: "In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation."

The vulnerability class is CWE-787 (Out-of-bounds Write). The root cause, as described, is a missing bounds check applied to data that is processed by the modem's baseband stack. In practical terms, an out-of-bounds write of this type means the code fails to validate the size or index of an input buffer before copying or writing into a fixed-size destination, allowing data to be written past the end of the intended buffer. This can corrupt adjacent memory — including control structures, return addresses, or function pointers — and is a classic precursor to code execution or privilege escalation.

The attack surface here is the air interface between a UE and the cellular network. The vulnerability is only reachable when the UE is camped on or connected to a base station that the attacker controls (a "rogue base station," also referred to in cellular security literature as an IMSI catcher or false base station). Because the malicious input is delivered over the radio link and processed by modem firmware, the flaw sits below the application processor and the mobile OS kernel — an attacker exploiting it does not need "additional execution privileges" on the device to trigger the write, and no user interaction is required.

The description does not disclose the specific radio-layer message, protocol layer (e.g., NAS, RRC, or a specific ASN.1 field), buffer, function, or firmware module affected. No CVE record provides the vendor/product string, the affected firmware versions, or the input that overflows. Any statement about the exact field or message type would be speculation and is therefore deliberately omitted. What can be stated with confidence is the vulnerability class: an unbounded write reachable from network-controlled input, breaking memory-safety guarantees in a privileged baseband context that is normally isolated from the application processor.

Two contextual points matter for defenders:

1. The baseband is a high-value, low-visibility target. Modem firmware typically runs on a separate processor with its own real-time OS and communicates with the host via shared memory and IPC channels. Compromise of the baseband can give an attacker a position beneath the operating system's isolation mechanisms.
2. Patch identification is non-standard. Tracking is keyed to patch ID MOLY01778988 and issue ID MSV-8897 rather than a semantic version number, consistent with how modem firmware is distributed and patched by chipset/device vendors. No public advisory mapping these identifiers to a specific product or firmware build was available at the time of writing.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-20520. The attack chain below is inferred strictly from the vulnerability class (out-of-bounds write) and the preconditions stated in the NVD description. No specific message names, protocol fields, or function names are asserted because none are provided in the source data.

1. Reconnaissance / target identification. The attacker stands up or configures a rogue base station using commodity software-defined radio (SDR) hardware and open-source base station stacks. The goal is to induce a target UE to camp on or attach to the false cell. This typically relies on broadcasting a stronger or more attractive signal than legitimate cells, or on downgrade/jamming techniques to force reselection. This is the same class of capability associated with IMSI catchers and has been demonstrated publicly in cellular security research.

2. Triggering the specific flaw class. Once the victim UE is connected to the attacker-controlled base station, the attacker sends network-originated signaling or data that is parsed by the modem. Because the described defect is a missing bounds check, the attacker supplies input whose size or index exceeds what the vulnerable code expects, causing the modem to write beyond the bounds of an intended buffer. Critically, the NVD description notes no additional execution privileges are needed — the malicious input arrives over the air and is handled by the baseband as part of normal network interaction, and no user interaction is required (the victim need not open a file, tap a link, or approve anything).

3. Payload / execution method (vulnerability-class level). In an out-of-bounds write, the attacker's ability to influence what is written and where determines the outcome. At minimum, the oversized or malformed input overwrites adjacent memory. Depending on the layout of the vulnerable buffer and the degree of attacker control over the written bytes, this can escalate from a denial-of-service/crash condition to controlled corruption of memory that influences execution flow. The description characterizes the achievable impact as remote escalation of privilege, indicating the corruption can be leveraged to gain code execution or elevated control within the modem's execution context rather than merely crashing it.

4. Post-exploitation impact. Successful escalation of privilege in the modem/baseband context places the attacker beneath the mobile OS security boundary. From there, an attacker could in principle gain a durable, hard-to-observe foothold, intercept or manipulate communications, and potentially pivot toward the application processor through the baseband-to-host interface. Because the exploit is network-delivered and requires no user action, it is well-suited to targeted surveillance against specific devices that enter the rogue cell's coverage — though, again, no in-the-wild exploitation has been confirmed for this specific CVE.

Detection caveat: Because the flaw is triggered over the air, conventional host- and network-layer telemetry rarely exposes it directly. The most reliable anomaly signals occur at the RF/radio layer (unexpected cell behavior, reselection to an unfamiliar cell, downgrade to weaker ciphering) rather than in host logs. This materially limits endpoint-only detection strategies.

Impact Assessment

If exploited, the impact is a remote escalation of privilege in modem firmware, reachable by a network-adjacent attacker (the rogue base station) with no authentication and no user interaction. Using a representative CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — the official vector is not published for this record), the vulnerability would rate as High/9.x, reflecting high confidentiality, integrity, and availability impact across an adjacent attack vector requiring no privileges or user action.

Affected systems are any devices with the vulnerable modem firmware that are reachable by the named patch (MOLY01778988 / MSV-8897). Because the vendor/product and affected version ranges were not disclosed in the provided data, the exact blast radius — specific device models, chipset families, or firmware builds — cannot be enumerated. The practical blast radius is therefore all UEs carrying the unpatched modem firmware that are within radio range of an attacker-controlled base station.

Business impact considerations:

• Regulatory and privacy exposure. For organizations in regulated sectors, baseband compromise can undermine the integrity of voice and data on managed mobile devices, with data-protection implications.
• High-value targets. The no-interaction, over-the-air nature makes this class of flaw attractive for surveillance-oriented targeting rather than mass exploitation.
• Remediation friction. Modem firmware is patched by chipset/device vendors and delivered via OEM updates, so remediation timelines depend on device vendors and, for some devices, carrier testing — often extending well beyond typical OS patch cycles.
• No known exploitation. CISA KEV does not list this CVE, and no public PoC or exploit code exists. There is currently no evidence of active exploitation.

Detection Guidance

Sigma Rule

Detection of over-the-air modem exploitation from host logs is inherently limited. The following rule targets the host-visible side effects most plausibly associated with a baseband memory-corruption fault — baseband/modem crash or restart telemetry and abnormal radio-state transitions.

title: Possible Modem/Baseband Memory Corruption Fault (CVE-2026-20520)
id: 6f2a1c9e-2052-4c7b-9d3e-000000000001
status: experimental
description: Detects baseband/modem crash, restart, or abnormal radio-state events that may indicate exploitation of an out-of-bounds write in modem firmware (CVE-2026-20520).
author: valtersit.com
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20520
logsource:
  category: system
  product: linux
detection:
  selection_modem:
    - 'modem'
    - 'baseband'
    - 'rild'
    - 'qmi'
    - 'IPA'
  selection_fault:
    - 'crash'
    - 'fatal'
    - 'reset'
    - 'panic'
    - 'restart'
    - 'assert'
  condition: selection_modem and selection_fault
falsepositives:
  - Routine modem power-saving resets
  - Legitimate baseband firmware updates
level: medium
tags:
  - attack.t1190
  - cve.2026.20520

YARA Rule

A YARA rule cannot detect this exploit directly, as no exploit artifact, sample, or firmware image is available. The following rule is a heuristic for surfacing indicators that researchers or defenders might use when triaging captured baseband firmware dumps, matching on the tracking identifiers associated with this vulnerability to flag the relevant firmware lineage for closer review.

rule CVE_2026_20520_Modem_Tracking_Markers
{
    meta:
        description = "Heuristic match for CVE-2026-20520 tracking identifiers in modem firmware artifacts; not a reliable exploit detector"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20520"
        date = "2026-01-01"
        severity = "informational"

    strings:
        $pid = "MOLY01778988" ascii wide
        $iid = "MSV-8897" ascii wide

    condition:
        any of them
}

Suricata IDS Rule

This vulnerability is triggered over the cellular air interface and is not visible to conventional IP-based network monitoring. No packet-level signature for the over-the-air trigger can be derived from the available data. The following rule detects an unencrypted/plaintext activity test using the placeholder identifiers only and should be treated as a template for organizations performing radio-layer capture, not a functional IP signature.

alert ip any any -> any any (msg:"CVE-2026-20520 Modem OOB Write - tracking marker reference (tuning required)"; flow:stateless; content:"MOLY01778988"; nocase; sid:2026205200; rev:1; reference:cve,2026-20520; metadata:created_at 2026_01_01, updated_at 2026_01_01; classtype:attempted-admin;)

Elastic Detection

Detects host-side process events consistent with a modem/baseband fault characteristic of a memory-corruption crash.

process where process.name in ("rild", "qmi-proxy", "modemmanager", "ipacm")
  and process.args in ("crash", "restart", "reset", "panic")

Splunk SPL Query

Correlates modem/baseband fault and reset events that could indicate exploitation attempts against CVE-2026-20520.

index=main ("modem" OR "baseband" OR "rild" OR "qmi")
  ("crash" OR "fatal" OR "panic" OR "reset" OR "restart")
| stats count values(message) as messages by host, source
| where count > 0

Wazuh OSSEC Rule

Wazuh rule matching modem/baseband fault log lines on Android/Linux hosts.

<group name="cve-2026-20520,modem,">
  <rule id="100520" level="10">
    <decoded_as>syslog</decoded_as>
    <match>(modem|baseband|rild|qmi).*(crash|fatal|panic|reset|restart)</match>
    <description>CVE-2026-20520: Possible modem/baseband memory corruption fault</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was available from any tracked source. No affected version ranges, vendor fix, or workaround were published in the provided data. Treat all guidance below as compensating-control-based rather than a confirmed fix.

1) Immediate mitigations (reduce exposure while unpatched):

• Minimize rogue-cell exposure. This is the single most effective lever, because exploitation requires the UE to connect to an attacker-controlled base station. Enable/leverage network protections that detect or block suspicious base stations where your platform or carrier supports them (e.g., false-base-station detection features, 5G authentication and encryption enforcement, and downgrade protections).
• Avoid known attack environments. For high-value or sensitive devices, avoid carrying them into venues where rogue base stations are plausible (public protests, hostile/travel environments, locations with unusual cell behavior).
• Prefer trusted connectivity. On sensitive devices, disable automatic cellular attach where operationally feasible, and prefer trusted Wi-Fi and VPN for data where that is an acceptable trade-off.
• Enforce modern ciphering. Where operators support it, ensure devices negotiate the strongest available air-interface ciphering and integrity protection; this constrains (but does not eliminate) rogue-station manipulation.
• Fleet inventory. Identify which managed devices carry modems affected by the tracking ID MOLY01778988 / MSV-8897 so patching can be prioritized once a vendor build is available.

2) Patch / upgrade steps:

• There is no confirmed patch available from a tracked source at this time. Do not claim a fix exists.
• When a vendor build referencing patch ID MOLY01778988 (issue MSV-8897) is published, treat it as a security-critical modem firmware update. Track it through your chipset/device vendor.
• Modem firmware is delivered by device OEMs, often via carrier-reviewed OTA updates; monitor OEM and carrier security bulletins and apply mobile OS security updates that bundle the baseband fix.
• Verify update installation at the device level (baseband version string / firmware build) rather than relying solely on OS build numbers.

3) Long-term hardening:

• Include baseband/modem firmware in your standard vulnerability and patch-management lifecycle rather than treating it as out-of-scope.
• Maintain an inventory that maps managed devices to chipset/module families and their associated tracking IDs, so OEM patches can be matched quickly.
• Adopt devices and platforms that support modern cellular security features (strong mutual authentication, protection against downgrade and false base stations) as a procurement criterion.
• For high-assurance use cases, evaluate layered controls (isolated/secure devices, minimized cellular dependence for sensitive operations) that reduce reliance on baseband integrity alone.

References

1. NVD — CVE-2026-20520: https://nvd.nist.gov/vuln/detail/CVE-2026-20520
2. CWE-787: Out-of-bounds Write — MITRE: https://cwe.mitre.org/data/definitions/787.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-20520 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Vendor patch tracking artifact referenced in the advisory — Patch ID MOLY01778988 / Issue ID MSV-8897 (no public advisory URL available at time of writing; consult the chipset/device OEM and mobile OS security bulletins).

Threat actor and exploit-in-the-wild note: No public PoC, exploit code, Nuclei template, or in-the-wild exploitation evidence exists for CVE-2026-20520. The CVE is not listed in CISA KEV, and no threat-actor campaign has been publicly associated with it. The rogue-base-station tradecraft described in the Exploitation Scenarios section is a general capability documented in cellular security literature and is not attributed to any specific actor for this vulnerability.