UNISOC Modem Bug Enables Over-the-Air RCE, CVSS 9.8

CVE-2026-66086. CVSS 9.8 critical. Confirmed via UNISOC security bulletin.

The flaw. Stack-based buffer overflow in UNISOC’s modem OTA (over-the-air) stack. Root cause: improper validation of scheduling information in LTE/5G System Information Block 1 (SIB1) messages. SIB1 is broadcast by a base station as part of normal radio protocol operation and is processed before the device OS has any visibility. No user interaction required. No elevated privileges required. Potential outcome: remote code execution or denial of service at the baseband layer.

Why baseband matters. Modem-level flaws operate below the Android OS and its application sandbox. A successful exploit at this layer is not bounded by normal OS security controls. This is not an app-layer vulnerability.

Analysis: Exploitation would require a rogue or compromised base station in range of the target. That raises the operational bar significantly compared to Wi-Fi or Bluetooth attacks. The capability exists in state-level and well-resourced threat actor toolkits.

Affected hardware. UNISOC chipsets are embedded in budget and mid-range Android devices across multiple manufacturers. The vendor advisory does not enumerate specific handset models. Users should check with their device OEM for patch availability.

Patch. UNISOC has published a fix. Delivery to end users follows OEM integration and carrier OTA schedules, which vary. OEM patch timelines: unconfirmed as of publication. Users on UNISOC-based hardware should monitor their OEM’s security bulletin page.

Active exploitation. Not reported. Confirmed exploitation status: unconfirmed.

Related: CVE-2026-66086 entry | Pwn2Own Ireland 2026 Final Scores | D-Link CVSS 10.0 Flaw Has No Fix