EUVD-2026-37196
GHSA-pmgw-xx83-hqxj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Modem RCE is realistically reached over the radio (AV:A), requires rogue-cell setup and protocol-specific crafting (AC:H), needs no auth at the radio layer (PR:N), and yields full code execution impact.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
4DescriptionCVE.org
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Remote code execution in the Android Modem component (per the Pixel 2026-06-01 security bulletin) is possible via an out-of-bounds write triggered without user interaction. Authenticated remote attackers (PR:L per CVSS) can corrupt memory to execute arbitrary code at the same privilege level as the Modem process. No public exploit identified at time of analysis, EPSS is low at 0.23% (13th percentile), and the issue is not listed in CISA KEV.
Technical ContextAI
The vulnerability lives in the Android Modem subsystem - the baseband/cellular firmware-and-driver stack that handles radio protocol parsing (LTE/5G/IMS signaling and related interfaces). The root cause is CWE-787 (Out-of-bounds Write), introduced by a missing bounds check on attacker-influenced input before writing into a fixed-size buffer, a classic memory-corruption primitive that, in the Modem context, can lead to control-flow hijack in a high-privilege component below the Android application sandbox. CPE coverage points specifically at cpe:2.3:a:google:android - i.e., the Google Android distribution, with Pixel devices explicitly addressed by the 2026-06-01 bulletin.
RemediationAI
Patch available per vendor advisory: install the Android/Pixel security update with patch level 2026-06-01 or later, as published in the June 2026 Pixel bulletin (https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01), and confirm the device's Android security patch level reflects that date after reboot. For fleets that cannot immediately update, useful compensating controls include disabling 2G fallback on supported devices to reduce exposure to rogue base stations (trade-off: degraded coverage in areas with only 2G), enabling Airplane Mode in high-risk environments (trade-off: no cellular service), and prioritizing patch rollout on devices that roam internationally or operate in untrusted RF environments. Cross-reference https://nvd.nist.gov/vuln/detail/CVE-2026-0164 and https://vuldb.com/vuln/371419 for additional advisory tracking.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today