CVE-2026-0154

HighCVSS 8.8/10Last modified Oct 25, 2026

Description

In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
GoogleAndroidAndroid kernel

References

Timeline

Published
Jun 16, 2026
Last modified
Oct 25, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-01555.3In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information discCVE-2026-01567.5In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remoteCVE-2026-01574.3In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosurCVE-2026-01584.0In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disCVE-2026-01598.8In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no aCVE-2026-01608.8In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds cCVE-2026-01618.8In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escCVE-2026-01628.8In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code executioCVE-2026-01639.8In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of prCVE-2026-01648.8In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additionalCVE-2026-01656.5In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. This could lead to reCVE-2026-01698.4In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test or debugging code. Th
CVE-2026-0154: High severity, CVSS 8.8 | Vulnix