UNISOC Modem OTA Stack Overflow via Malformed SIB1 Message
Stack-based buffer overflow in the UNISOC modem OTA stack, triggered by malformed LTE/5G SIB1 scheduling data. Outcome is remote code execution or denial of service with no user interaction required. CVSS 9.8.
- Vendor
- UNISOC
- Product
- UNISOC modem chipsets (OTA stack)
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Stack-based buffer overflow in the UNISOC modem OTA stack. The flaw is triggered by improper validation of scheduling information embedded in LTE/5G System Information Block 1 (SIB1) messages. Because SIB1 is broadcast by the base station and processed at the baseband layer, no user interaction is required to reach the vulnerable code path.
UNISOC published a security bulletin with patch guidance. Distribution to end devices depends on OEM integration and carrier OTA timelines.
UNISOC chipsets are present in a broad range of budget and mid-range Android handsets across multiple manufacturers. Specific affected device models are not enumerated in the vendor advisory.
No active exploitation has been reported. Active exploitation status: unconfirmed as of publication.
