Android Cellular Modem CVE-2026-56967

Exploitation requires the attacker to be within adjacent/proximal cellular radio range of the target and able to inject crafted over-the-air signaling that reaches the vulnerable Cellular Modem parsing path - typically via a rogue base station, IMSI catcher-class equipment, or a compromised small cell, which is why the vector is AV:A rather than AV:N. It requires no user interaction (UI:N), and the CVSS vector marks low privileges (PR:L), which conflicts with the description's statement that no additional execution privileges are needed - this discrepancy should be resolved against the vendor bulletin before assuming unauthenticated reachability. Limiting factors: the flaw is not exploitable over the internet (proximity to the radio interface is mandatory), it is platform/OEM-specific to devices carrying the affected modem implementation, and exploitation is harder if the device is on Wi-Fi-only with the cellular radio disabled or if legacy 2G/3G fallback is turned off. No preconditions involving a specific app, endpoint, or non-default configuration setting were identified in the available data.

The CVSS 3.1 vector scores this 8.0 with AV:A (adjacent network), AC:L, PR:L, UI:N and high C/I/A, which places exploitation squarely in the radio-proximity domain rather than the internet-remote domain: an attacker needs to be within cellular/adjacent range (for example operating a rogue base station or compromised small cell) rather than merely having an IP path to the device. EPSS and CISA KEV data were not supplied, and no public exploit code was indicated, so this is not confirmed as actively exploited; treat it as a high-severity, plausibly automatable radio-adjacent bug whose real priority depends on whether the modem parsing path is reachable pre-authentication. There is an internal inconsistency worth flagging: the description states no additional execution privileges are needed, while the CVSS vector marks PR:L - the effective privilege precondition should be verified against the vendor bulletin before teams downgrade or upgrade severity. Because adjacent-network exploitation is automatable and requires no user interaction, this is more actionable than a typical local-only memory-safety bug, but less urgent than an internet-facing unauthenticated RCE.

An attacker deploys a rogue base station or compromised small cell within radio range of the target device and transmits crafted cellular signaling messages that reach the vulnerable modem parsing routine. The malformed input overflows a heap buffer, producing an out-of-bounds write that corrupts modem heap metadata or a function pointer and allows code execution in the baseband context without any user interaction. Because the attack is proximity-based and automated, it can be run against many devices passing through a physical area, and no public exploit code has been identified to date, meaning a working attack would currently require custom tooling or a software-defined-radio setup.