CVE-2026-20458
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In the Modem module, a possible memory corruption due to a missing bounds check could lead to remote escalation of privilege if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.
Risk Assessment
The risk involves potential remote takeover of the device by an attacker impersonating a legitimate base station, which could compromise data confidentiality, integrity, and network availability.
Recommendation
It is recommended to immediately apply the patch identified as MOLY01402160 and update the modem software to the latest version to eliminate the memory corruption vulnerability.
Other vulnerabilities in Modem
See all- CVE-2026-21555High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21554High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21553High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21552High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21551High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21550High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21549High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-20479High
In Modem, a missing bounds check could lead to an out-of-bounds read, allowing remote denial of service if the UE connects to a rogue base station controlled by the attacker. No additional privileges or user interaction are needed.
- CVE-2026-20463Medium
In the Modem module, a vulnerability was found that allows privilege escalation through a permissions bypass. This can be exploited locally if the attacker already has System privileges. User interaction is not required for exploitation.
- CVE-2026-20461Medium
In the Modem module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
Original NVD description (English source)
In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01402160; Issue ID: MSV-7298.