CVE-2026-0154: In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption

Synopsis

Memory corruption in the Android modem component can be triggered remotely by sending a malformed SIP REFER request, requiring only a low-privilege account with no user interaction. Successful exploitation gives an attacker remote code execution inside the modem process with no additional privilege escalation needed, enabling full confidentiality, integrity, and availability impact. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker sends the malformed SIP REFER request over the network to reach the modem component, requiring network-level access to the target.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning any low-privilege account is sufficient; no administrator or root-level credentials are needed.

• Victim interactionNot required

  Exploitation is fully remote and automated; no action from a user on the target device is needed.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free, with no race conditions or specific memory-layout dependencies required.

Blast Radius

• An attacker achieves remote code execution inside the modem process, gaining the ability to run arbitrary code at that privilege level.
• All data passing through or stored by the modem component, including call signaling and session credentials, becomes readable to the attacker.
• The attacker can modify modem state, intercept or manipulate SIP sessions, and alter data in transit.
• The modem process crashes or is held under attacker control, disrupting voice, data, and signaling services on the affected device.