CVE-2026-0154: Android Modem Memory Corruption Remote Code Execution via SIP REFER

Technical summary

CVE-2026-0154 is a memory corruption vulnerability (CWE-120) in the Android modem stack that manifests during SIP REFER request processing. The flaw allows an authenticated remote attacker to craft a specially malicious SIP REFER packet that corrupts memory in the modem firmware, leading to a crash and potential code execution in the modem's execution context. The attack requires only network-layer access and valid SIP credentials; no privilege escalation or user interaction is necessary. The CVSS 3.1 score of 8.8 reflects the high impact across confidentiality, integrity, and availability.

Business impact

This vulnerability creates a significant operational risk for organizations relying on Android-based devices for voice communications, particularly in unified communications, VoIP-dependent workflows, and mobile-first enterprises. A successful exploit can disable cellular connectivity without user awareness, degrade service availability, and in the worst case, enable persistent firmware-level compromise. The lack of a public exploit and absence from the KEV catalog suggest limited current threat activity, but the ease of triggering and the high CVSS score warrant urgent attention, especially for devices in sensitive operational environments.

Affected systems

Google Android devices with vulnerable modem firmware are affected. The specific modem vendors and firmware versions are not disclosed in the public advisory and should be confirmed against Google's official security bulletin and individual device manufacturer statements. Organizations should check their device inventory against Google's patch schedule and individual OEM (OnePlus, Samsung, Motorola, etc.) security advisories for exact affected models and versions.

Exploitability

The attack is moderately accessible: an attacker must be on the network path to the target device and possess valid SIP authentication credentials. However, the attack requires no user interaction, low attack complexity, and succeeds with only user-level privileges on the network. The relatively low barrier to exploitation—once credentials are obtained—combined with the catastrophic impact makes this a practical threat in environments where SIP credentials are compromised or where internal network security is weak. Public exploit code is not yet available.

Remediation

Apply the latest security patches from Google and your device manufacturer. Google will release patches through monthly Android security bulletins; OEMs typically follow within 30–90 days. Device owners should enable automatic security updates and verify patch installation by checking the security patch date in device settings (Settings > About > Security patch level). For enterprises, coordinate with mobile device management (MDM) solutions to enforce patch deployment across the fleet.

Patch guidance

Patches will be released in Google's monthly security bulletin and coordinated with device manufacturers. Verify the security patch date in device settings; patches addressing this CVE will be documented in the associated bulletin. Test patches on a representative device before enterprise rollout. For devices no longer receiving updates, consider device replacement or network-level mitigations such as VoIP traffic inspection and SIP credential rotation.

Detection guidance

Monitor network logs for malformed or anomalous SIP REFER requests destined for vulnerable devices. Watch for unexpected modem resets or cellular connectivity loss correlated with SIP traffic. On-device, check system logs (via adb logcat or device-side logging) for modem firmware crash dumps. Intrusion detection systems with SIP protocol awareness can flag malformed REFER packets. Consider deploying a network-based SIP validation gateway to block malicious requests before they reach endpoints.

Why prioritize this

This vulnerability merits immediate prioritization due to its high CVSS score (8.8), the complete lack of required user interaction, the low bar for network-level access, and the potential for achieving code execution in the modem's trusted execution environment. Although not yet exploited in the wild (KEV status: false), the technical difficulty is low relative to the impact. Organizations with voice-critical workflows, sensitive communications requirements, or known SIP infrastructure vulnerabilities should patch as a matter of urgency.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects an attack vector that is network-accessible (AV:N), requires minimal attack complexity (AC:L), needs user-level credentials but not administrative privilege (PR:L), and causes no user interaction (UI:N). The vulnerability affects only the vulnerable system itself (S:U) but completely compromises confidentiality, integrity, and availability (C:H/I:H/A:H). This combination—easy exploitation coupled with severe impact—places it in the high-risk category.

Frequently asked questions