What is the CVSS score of EUVD-2026-41496?

EUVD-2026-41496 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Unisoc IMS are affected by EUVD-2026-41496?

CVE-2026-4967 affects Unisoc chipsets widely deployed in budget Android smartphones, enabling remote denial-of-service attacks on the IMS (IP Multimedia Subsystem) component without authentication.

How to fix or mitigate EUVD-2026-41496?

24 hours: Inventory all devices using affected Unisoc SoCs (SC7731E, SC9832E, SC9863A, T310, T610, T618, T7200-series, T8100, T8200, T8300, T9100) in your infrastructure and assess their role in critical systems. 7 days: Contact affected device manufacturers and Unisoc for patch availability timelines; conduct risk assessment on systems dependent on these devices. 30 days: Implement network-level monitoring for anomalous IMS traffic patterns; evaluate network segmentation strategies for vulnerable devices or staged replacement in high-risk deployments.

Unisoc IMS EUVD-2026-41496

| CVE-2026-4967 HIGH

2026-07-03 Unisoc

GHSA-5fx8-7mc9-6rhf

Buffer Overflow Denial Of Service Sc7731E Sc9832E Sc9863A T310 T610 T618 T7200 T7225 T7250 T7255 T7280 T7300 T8100 T9100 T8200 T8300 Unisoc Shanghai Technologies Co Ltd

7.5

CVSS 3.1 · Vendor: Unisoc

Severity by source

Vendor (Unisoc) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated, no-interaction IMS signaling triggers an out-of-bounds read causing a crash, so PR:N/UI:N with availability-only impact (A:H, C:N, I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Unisoc).

CVSS VectorVendor: Unisoc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 07:21 vuln.today

DescriptionCVE.org

In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed.

AnalysisAI

Remote denial of service in the IMS (IP Multimedia Subsystem) implementation of Unisoc mobile chipsets allows an unauthenticated remote attacker to crash the affected component via an out-of-bounds read triggered by a missing bounds check. The flaw spans a broad range of Unisoc SoCs (SC7731E, SC9832E, SC9863A, T310/T610/T618, T7200-series, T8100/T8200/T8300, T9100) commonly used in budget Android smartphones. It carries CVSS 7.5 with availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the IMS (IP Multimedia Subsystem) stack, the SIP/IMS signaling layer that Unisoc chipsets use to deliver VoLTE, VoWiFi, and RCS services over the operator network. The root cause is an out-of-bounds read from a missing bounds check while parsing IMS signaling data, corresponding to CWE-125 (Out-of-bounds Read) even though the CWE field is unpopulated ('N/A') in the source record. Because IMS parsing runs in the baseband/modem or associated telephony service, input read past a buffer boundary causes the component to fault rather than leak attacker-controllable memory, producing a crash (denial of service) instead of code execution. The affected component is identified through the CPE as Unisoc (Shanghai) Technologies chipsets spanning entry-level and mid-range Spreadtrum/Unisoc SoC families.

RemediationAI

Apply the fix distributed through the Unisoc Product Security Bulletin (https://www.unisoc.com/en/support/product-security-bulletin/2072920457676509185) as delivered by your device OEM's firmware/security update for the affected chipset; because no exact patched build version is provided in the source data, treat this as patch available per vendor advisory and confirm the specific baseband/firmware version with the OEM. As no independent fixed version is confirmed and end-user configuration options for baseband parsing are limited, compensating controls are constrained: on managed fleets, consider disabling VoLTE/VoWiFi (IMS) where operationally acceptable to remove the affected signaling path - at the cost of losing HD voice and Wi-Fi calling - and prioritize devices that still receive vendor security patches. Network operators can additionally filter malformed IMS/SIP signaling at the IMS core.