CVE-2026-66085
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.
Risk Assessment
A local attacker could access sensitive data contained in crash dumps, potentially compromising confidentiality. The lack of required privileges increases the risk.
Recommendation
Implement filtering of sensitive data in crash dumps and restrict access to dump files. Update modem software when a fix becomes available.
Other vulnerabilities in Modem
See all- CVE-2026-20543Medium
In the Modem component, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20541Medium
In the Modem component, there is a possible out-of-bounds read due to a missing permission check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20540Medium
In the Modem component, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20539Medium
In the Modem module, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.
- CVE-2026-20538Medium
In the Modem module, there is a possible out-of-bounds read due to a missing permission check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.
- CVE-2026-20534Medium
In the Modem module, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.
- CVE-2026-20527Medium
In the Modem component, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.
- CVE-2026-20526High
In the Modem component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote privilege escalation if a UE connects to a rogue base station controlled by the attacker. User interaction is needed, but no additional execution privileges are required.
- CVE-2026-20525Medium
In the Modem component, there is a possible system crash due to improper input validation. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.
- CVE-2026-20520High
In the Modem component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote privilege escalation if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.
Original NVD description (English source)
In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

