What is the CVSS score of CVE-2026-0154?

CVE-2026-0154 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Android Modem are affected by CVE-2026-0154?

Google Pixel and Android devices are vulnerable to remote code execution in the cellular modem firmware through crafted SIP REFER requests on the IMS/VoLTE signaling network, requiring no user…

How to fix or mitigate CVE-2026-0154?

Within 24 hours, use your MDM platform to obtain a complete inventory of Google Pixel and Android devices with their current modem firmware versions; subscribe to Google's official security bulletins and CISA alerts for CVE-2026-0154 updates. Within 7 days, map which devices access sensitive corporate data, credentials, or critical systems to establish remediation priority; document your organization's dependency on VoLTE services to inform interim mitigation feasibility. Within 30 days, monitor Google's security advisories for patch availability; once released, test the patch in a controlled MDM environment against your supported device models and establish a phased deployment schedule prioritizing high-value devices (executive, engineering, finance) before broad rollout.

Android Modem CVE-2026-0154

EUVD-2026-37188 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-16 Google_Devices

GHSA-2c4x-2rp9-wr2h

RCE Buffer Overflow Google

8.8

CVSS 3.1 · CISA-ADP

Severity by source

CISA-ADP PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Baseband SIP RCE needs an attacker in the IMS/telephony signaling path (AV:A) and crafted-message conditions (AC:H); no user privileges or interaction on the device (PR:N/UI:N), with total modem impact (C/I/A:H).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from CISA-ADP.

CVSS VectorCISA-ADP

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:08 vuln.today

CVE Published

Jun 16, 2026 - 18:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 16, 2026 - 18:51 cve.org

HIGH 8.8

DescriptionCVE.org

In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Remote code execution in the cellular baseband (modem) firmware of Google Android/Pixel devices is possible through a memory-corruption flaw triggered while parsing a SIP REFER request, with no user interaction required. An attacker able to deliver a crafted SIP REFER message over the IMS/VoLTE signaling path can corrupt modem memory to crash the baseband or execute arbitrary code within the modem context. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records exploitation status as none, indicating no observed in-the-wild use.

Technical ContextAI

The vulnerability lives in the baseband modem's SIP (Session Initiation Protocol) handling stack, which processes IMS/VoLTE call-control signaling. SIP REFER is the method used to trigger call transfer, and improper bounds checking while parsing that request produces the classic CWE-120 condition (buffer copy without checking size of input, i.e., a buffer overflow). Because the modem is a separate real-time processor with its own memory and privileged position between the radio network and the application processor, corruption here executes below the Android OS security boundary. The affected component is identified via CPE cpe:2.3:a:google:android and the Pixel security bulletin; the flaw is in vendor/proprietary modem firmware rather than the Linux kernel, despite the EUVD 'Android kernel' label.

RemediationAI

Patch available per vendor advisory: apply the Google Pixel/Android security update corresponding to the 2026-06-01 (June 2026) patch level or later, as documented at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01; an exact fixed firmware version string is not provided in the source data, so confirm the specific build against the bulletin. For fleets that cannot immediately update, compensating controls target the IMS/VoLTE signaling exposure: disable VoLTE/Wi-Fi Calling (IMS) on high-risk devices where feasible (trade-off: calls fall back to circuit-switched voice and Wi-Fi Calling is lost), restrict devices to trusted carrier networks and avoid untrusted/femtocell or rogue base-station environments, and use MDM policies to enforce prompt update rollout. These mitigations reduce the reachable attack surface but do not remove the underlying modem flaw, so patching remains the only complete fix.