CVE-2026-20562
MediumCVSS 5.3Summary
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
Risk Assessment
An attacker could remotely cause a modem crash and denial of service on the victim's device, potentially disrupting connectivity. However, this requires connection to a rogue base station.
Recommendation
Apply the update containing patch MOLY01775984. Monitor for unusual network behavior and avoid connecting to untrusted base stations.
Other vulnerabilities in Modem
See all- CVE-2026-68591Medium
In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
- CVE-2026-68589Medium
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
- CVE-2026-68588Medium
In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20600Medium
In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20599Medium
In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
- CVE-2026-20598Medium
In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20597Medium
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
- CVE-2026-20596Medium
In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
- CVE-2026-20594Medium
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
- CVE-2026-20593Medium
In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
Original NVD description (English source)
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775984; Issue ID: MSV-8907.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

