CVE-2026-0136: Android Modem Out-of-Bounds Read Denial of Service

Technical summary

CVE-2026-0136 is an out-of-bounds read vulnerability in the modem subsystem stemming from insufficient bounds validation. The vulnerability falls under CWE-120 (Buffer Copy without Checking Size of Input) and CWE-125 (Out-of-bounds Read), indicating a classic memory safety issue where the code reads beyond allocated buffer boundaries. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects network-based exploitation requiring low attack complexity and valid credentials, with high availability impact but no confidentiality or integrity breach. The lack of user interaction requirement indicates the attack can be fully automated once an attacker possesses valid authentication.

Business impact

The denial of service impact poses operational risk to organizations deploying Android devices in critical roles. While the vulnerability does not enable data exfiltration or system compromise, attackers can remotely disable targeted devices, disrupting communications, field operations, or any service dependent on continuous device availability. For enterprises managing fleets of Android-based infrastructure or mobile devices, widespread exploitation could fragment network resources and necessitate device recovery procedures. The authentication requirement limits the threat to insider scenarios or cases where an attacker has compromised user credentials through phishing or prior breach.

Affected systems

Google Android devices running vulnerable modem firmware are affected. The modem is a baseband processor component handling cellular connectivity, meaning all Android devices with cellular radios are potentially in scope. Determine your specific device models and Android versions by cross-referencing Google's security advisory for this CVE, as patch availability varies by manufacturer, carrier, and device age.

Exploitability

Exploitability is moderate in scope. The attack requires valid login credentials on the target system, which narrows the attacker pool to insiders, compromised user accounts, or those who have defeated authentication through other means. However, once authenticated, the exploit itself is trivial to execute—no special privileges, kernel access, or additional vulnerabilities are needed. No known public exploit code or weaponized tooling is currently flagged in the CISA KEV catalog, but the straightforward nature of an out-of-bounds read in modem code suggests exploit development poses no significant technical barrier.

Remediation

Apply the official modem firmware update issued by Google and your device manufacturer as soon as it becomes available. Firmware updates for cellular basebands typically arrive through over-the-air (OTA) pushes managed by carriers, so ensure device auto-update settings are enabled and check your carrier's security bulletin for timing. Organizations should also enforce strong authentication practices—enforce multi-factor authentication on sensitive accounts, monitor for credential compromise, and segment network access to limit the damage from a compromised user account.

Patch guidance

Monitor Google's Android Security & Privacy Bulletins and your device manufacturer's security pages for modem firmware patches addressing CVE-2026-0136. Patches will be delivered through OTA updates; verify your device has installed the latest modem firmware by checking Settings > About Phone > Build Number or manufacturer-specific firmware info. If your organization manages Android devices in bulk, coordinate with your Mobile Device Management (MDM) provider to track patch deployment across your fleet. For carriers, apply updates to their baseband provisioning systems promptly to ensure all devices receive the fix.

Detection guidance

Monitor system logs for unexpected modem crashes, resets, or cellular connectivity loss, particularly if these events correlate across multiple devices or occur outside normal patterns. Intrusion detection systems and UEBA tools should flag authentication events from suspicious user accounts followed by network traffic patterns consistent with denial-of-service attacks on modem services. Cellular network operators can monitor for anomalous modem restart patterns or signaling plane abuse originating from known subscriber credentials. Endpoint management platforms should inventory modem firmware versions and flag devices running outdated versions after a patch is released.

Why prioritize this

This vulnerability merits prompt but not emergency action. The CVSS 6.5 MEDIUM rating and absence from the KEV catalog reflect that real-world exploitation requires authentication, which is a meaningful barrier. However, the availability impact is high and the ease of exploitation once authenticated is very low, making it attractive to insiders or attackers with stolen credentials. Prioritize patching for devices in high-availability environments (hospitals, emergency services, critical infrastructure) and those with elevated insider risk, then roll out broadly as patches become available.

Risk score, explained

The CVSS 6.5 score reflects a network-accessible but authenticated vulnerability with high availability impact. The score does not account for real-world context such as low adoption of out-of-band modem exploitation tooling or the difficulty most attackers face in obtaining valid credentials at scale. However, the straightforward nature of memory safety bugs and the ubiquity of Android devices mean the floor for exploitation by determined actors is low. Organizations using Android in critical or sensitive roles should treat this as a higher priority than the base score alone suggests.

Frequently asked questions