CVE-2026-0152

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bounds due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 16, 2026
Last modified
Jun 17, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-01537.8In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalaCVE-2026-01548.8In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This could lead to remote coCVE-2026-01555.3In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information discCVE-2026-01567.5In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remoteCVE-2026-01574.3In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosurCVE-2026-01584.0In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disCVE-2026-01598.8In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no aCVE-2026-01608.8In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds cCVE-2026-01618.8In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escCVE-2026-01628.8In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code executioCVE-2026-01639.8In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of prCVE-2026-01648.8In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional
CVE-2026-0152: High severity, CVSS 7.8 | Vulnix