EUVD-2026-37170
GHSA-v589-m7cv-cj7m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Modem is network-reachable with no user interaction; PR:L reflects cellular or protocol-level access requirement; impact is availability-only (modem crash), with no confidentiality or integrity consequence.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Remote denial of service in Android's Modem component can be triggered by a low-privileged remote attacker exploiting a missing bounds check, causing an out-of-bounds read that crashes the modem subsystem. Affecting Google Android devices - specifically Pixel devices per the June 2026 Pixel Security Bulletin - the vulnerability requires low privilege but no user interaction, and carries a CVSS score of 6.5 (Medium). No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.25% at the 16th percentile signals very low near-term exploitation probability, consistent with the SSVC assessment of exploitation: none.
Technical ContextAI
The vulnerability exists within the Modem component of Google Android (CPE: cpe:2.3:a:google:android:*:*:*:*:*:*:*:*), which processes cellular network protocol messages and signal data. The root cause is CWE-125 (Out-of-bounds Read): a missing bounds check allows crafted input to cause a read operation beyond the allocated buffer boundary, which crashes the modem subsystem. Although the vulnerability is tagged 'Buffer Overflow' in threat intelligence feeds, the CWE classification clarifies this as a read-side bounds violation rather than a write overflow. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the modem is reachable over a network channel at low complexity, though some protocol-level or authenticated access (PR:L) is required. The impact is confined to availability - there is no confidentiality or integrity consequence indicated by the description or CVSS metrics.
RemediationAI
Apply the June 2026 Pixel security update as documented in the Google Pixel Security Bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01. Pixel device users should install the 2026-06-01 security patch level or later via the standard OTA update mechanism. An exact fixed version number is not independently confirmed from the available data - the Pixel bulletin should be consulted directly for the specific build identifier. As a compensating control in high-sensitivity environments where patching is delayed, placing devices in airplane mode eliminates modem exposure entirely but disables all cellular connectivity. No other targeted workarounds are identified from available intelligence. Upstream fix availability for non-Pixel Android OEMs is not confirmed and should be verified with respective device manufacturers.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today