CVE-2026-20519
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
Risk Assessment
An attacker could exploit a rogue base station to remotely escalate privileges on the victim's device via the modem. This poses a serious threat to the confidentiality, integrity, and availability of mobile devices in the organization.
Recommendation
Immediately apply the update containing patch MOLY01778993 for the modem. Until deployment, restrict connections to untrusted cellular networks and monitor for unusual base station connections.
Other vulnerabilities in Modem
See all- CVE-2026-20543Medium
In the Modem component, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20541Medium
In the Modem component, there is a possible out-of-bounds read due to a missing permission check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20540Medium
In the Modem component, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20539Medium
In the Modem module, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.
- CVE-2026-20538Medium
In the Modem module, there is a possible out-of-bounds read due to a missing permission check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.
- CVE-2026-20534Medium
In the Modem module, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.
- CVE-2026-20527Medium
In the Modem component, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.
- CVE-2026-20526High
In the Modem component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote privilege escalation if a UE connects to a rogue base station controlled by the attacker. User interaction is needed, but no additional execution privileges are required.
- CVE-2026-20525Medium
In the Modem component, there is a possible system crash due to improper input validation. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.
- CVE-2026-20520High
In the Modem component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote privilege escalation if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.
Original NVD description (English source)
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778993; Issue ID: MSV-8898.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

