CVE-2026-20534: Out-of-bounds Read

In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20540: Buffer Over-read

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20541: Buffer Over-read

In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitatio...

CVE-2026-20527: Improper Validation of Array Index

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I...

PT-2026-104680

Name of the Vulnerable Software and Affected Versions MediaTek MT2716 affected versions not specified Description A missing bounds check in the Modem component allows an out-of-bounds write. This issue can be exploited by a remote attacker who controls a rogue base station to achieve escalation o...

PT-2026-104687

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I...

kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow

A flaw was found in the Linux kernel's t7xx WWAN driver. A malicious, buggy, or compromised modem firmware can exploit this by sending packets with excessive fragments. This leads to a buffer overflow in the skbshinfoskb-frags array, corrupting adjacent memory. This can result in kernel crashes o...

Cellular Modem Component Android Privilege Bypass

The vulnerability of the Cellular Modem component in the Android operating system of Pixel phones is related to improper authorization. Exploiting this vulnerability allows a remote attacker to bypass existing security measures and gain increased privileges...

Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation

Google has disclosed that a high-severity security flaw in its Pixel Cellular Modem has come under exploitation in the wild. The vulnerability, tracked as CVE-2026-58704 CVSS score: 8.0, is a privilege escalation flaw. "In Cellular Modem, there is a possible permission bypass due to a logic error...

Google Pixel owners urged to patch actively exploited modem flaw

Google has released its September 2026 Pixel Update Bulletin, fixing 110 vulnerabilities, including one that it says "may be under limited, targeted exploitation.” The bug is not described as a simple remote takeover, but as a vulnerability that could give an attacker who already has a foothold o...

EUVD-2026-80015

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

Google Pixel Improper Authorization Vulnerability

Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges...

CVE-2026-82567

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

CVE-2026-82567 mySCADA myPRO Manager Missing Authorization

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

CVE-2026-82567

mySCADA myPRO Manager exposes an unauthenticated HTTP endpoint in its notification gateway that accepts a phone number and message to send SMS via a connected GSM modem. Because no credentials are required, any attacker with adjacent network access can trigger arbitrary SMS messages through the d...

CVE-2026-82567 mySCADA myPRO Manager Missing Authorization

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

CVE-2026-58704

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote proximal/adjacent escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57008

In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56975

In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote proximal/adjacent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56967

In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...