CVE-2026-20433

CVE-2026-20433 is an out-of-bounds write vulnerability in Modem caused by a missing bounds check that could enable remote privilege escalation if a device connects to an attacker-controlled rogue base station. No additional execution privileges are required for exploitation, though user interaction is necessary. The vulnerability carries a CVSS score of 8.8 (HIGH) with an adjacent network attack vector, low complexity, and no privilege requirements. Successful exploitation could result in complete compromise of confidentiality, integrity, and availability on affected systems. There is currently no evidence of active exploitation in the wild, with no known public exploits available and the vulnerability absent from CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 0.00023 indicates very low probability of exploitation relative to other CVEs, and the vulnerability remains on an inactive hot list, suggesting minimal community attention at this time.