CVE-2026-0132
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed.
Risk Assessment
This vulnerability poses a serious risk to organizations as it allows for remote code execution without user interaction.
Recommendation
It is recommended to update the Modem software to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Modem
See all- CVE-2026-66085Medium
In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2026-20543Medium
In the Modem component, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20541Medium
In the Modem component, there is a possible out-of-bounds read due to a missing permission check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20540Medium
In the Modem component, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20539Medium
In the Modem module, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.
- CVE-2026-20538Medium
In the Modem module, there is a possible out-of-bounds read due to a missing permission check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.
- CVE-2026-20534Medium
In the Modem module, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.
- CVE-2026-20527Medium
In the Modem component, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.
- CVE-2026-20526High
In the Modem component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote privilege escalation if a UE connects to a rogue base station controlled by the attacker. User interaction is needed, but no additional execution privileges are required.
- CVE-2026-20525Medium
In the Modem component, there is a possible system crash due to improper input validation. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.
Original NVD description (English source)
In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

