CVE-2026-20526: Out-of-bounds Write

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-20539: Buffer Over-read

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20527: Improper Validation of Array Index

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I...

CVE-2026-20538: Buffer Over-read

In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitatio...

CVE-2026-20534: Out-of-bounds Read

In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20541: Buffer Over-read

In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitatio...

CVE-2026-20525: Reachable Assertion

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patc...

CVE-2026-20519: Out-of-bounds Write

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-20540: Buffer Over-read

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-104679

Name of the Vulnerable Software and Affected Versions MediaTek Modem affected versions not specified Description A missing bounds check in the modem allows for an out-of-bounds write. This issue can be exploited if a User Equipment UE connects to a rogue base station controlled by an attacker,...

kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow

A flaw was found in the Linux kernel's t7xx WWAN driver. A malicious, buggy, or compromised modem firmware can exploit this by sending packets with excessive fragments. This leads to a buffer overflow in the skbshinfoskb-frags array, corrupting adjacent memory. This can result in kernel crashes o...

Cellular Modem Component Android Privilege Bypass

The vulnerability of the Cellular Modem component in the Android operating system of Pixel phones is related to improper authorization. Exploiting this vulnerability allows a remote attacker to bypass existing security measures and gain increased privileges...

Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation

Google has disclosed that a high-severity security flaw in its Pixel Cellular Modem has come under exploitation in the wild. The vulnerability, tracked as CVE-2026-58704 CVSS score: 8.0, is a privilege escalation flaw. "In Cellular Modem, there is a possible permission bypass due to a logic error...

Google Pixel owners urged to patch actively exploited modem flaw

Google has released its September 2026 Pixel Update Bulletin, fixing 110 vulnerabilities, including one that it says "may be under limited, targeted exploitation.” The bug is not described as a simple remote takeover, but as a vulnerability that could give an attacker who already has a foothold o...

EUVD-2026-80015

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

Google Pixel Improper Authorization Vulnerability

Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges...

CVE-2026-82567

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

CVE-2026-82567

mySCADA myPRO Manager exposes an unauthenticated HTTP endpoint in its notification gateway that accepts a phone number and message to send SMS via a connected GSM modem. Because no credentials are required, any attacker with adjacent network access can trigger arbitrary SMS messages through the d...

CVE-2026-82567 mySCADA myPRO Manager Missing Authorization

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

CVE-2026-82567 mySCADA myPRO Manager Missing Authorization

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...