EUVD-2026-37209
GHSA-w64x-57p5-wvvh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
WC-Radio is a baseband-style component reached over radio proximity (AV:A), exploitation needs a precisely crafted frame (AC:H), but no auth or interaction is required and impact is total.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Remote code execution in the WC-Radio component on Google Android (Pixel) devices allows network-adjacent attackers to corrupt memory via an out-of-bounds write with no authentication or user interaction. The flaw carries a CVSS 9.8 rating and is addressed in the Pixel security bulletin dated 2026-06-01; no public exploit identified at time of analysis and EPSS is low at 0.15%.
Technical ContextAI
The vulnerability resides in WC-Radio, a baseband/radio-layer component shipped within the Android stack (per CPE cpe:2.3:a:google:android and the Pixel bulletin reference). The root cause is CWE-787 (Out-of-bounds Write), where missing bounds validation on input data allows an attacker-controlled write past the end of an allocated buffer, corrupting adjacent memory structures. Because radio components typically run with elevated privileges and process attacker-influenceable wireless protocol data, a memory-corruption defect here can translate directly into native code execution in a privileged process context without traversing the normal application sandbox.
RemediationAI
Apply the Pixel security patch level dated 2026-06-01 or later as published in the Google bulletin (https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01); the exact fix build for Pixel devices is enumerated in that advisory. For non-Pixel Android OEMs, install the corresponding monthly security update from the device manufacturer once it incorporates this fix. Until the patch is deployed, compensating controls are limited because WC-Radio is invoked by baseband/radio traffic rather than user-driven app flows: where feasible, disable the affected radio interface (for example placing the device in airplane mode in untrusted RF environments) or restrict device use to controlled radio environments, accepting the obvious loss of connectivity that mitigation imposes; standard application-layer controls and MDM hardening will not block this code path.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today