CVE-2026-0136: Medium severity Google Android vulnerability
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable any remote management/administration interfaces on the modem (remote web UI, TR-069, SSH, etc.) if they are not required to reduce exposure to remote attacks.
Modem remote_management = disabled - Compensating control
Restrict network access to the modem from untrusted networks: block or rate-limit management and protocol ports at the network perimeter, allow access only from trusted IP ranges or via a VPN, and place the modem on an isolated management VLAN.
- Operational
Monitor the modem for crashes, unexpected reboots, service interruptions, and abnormal logs; maintain an operational playbook to restart or replace the device and preserve logs for analysis if a denial-of-service is observed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0136?
The severity of CVE-2026-0136 is medium with a score of 6.5 according to the CVSS 3.1 metrics.
How does CVE-2026-0136 affect users?
CVE-2026-0136 can result in a remote denial of service, impacting the stability of the device without requiring any user interaction.
What software is impacted by CVE-2026-0136?
CVE-2026-0136 specifically affects Google Android devices.
Is there a fix for CVE-2026-0136?
As of now, to mitigate CVE-2026-0136, users should update their Google Android to the latest security patches provided by the manufacturer.
What type of vulnerability is CVE-2026-0136?
CVE-2026-0136 is classified as an out of bounds read vulnerability due to a missing bounds check.