CVE-2026-20555: Medium severity Google Android vulnerability

Q: What must an attacker do to exploit this issue?

The attacker must operate or control a rogue base station and have a UE connect to it. No additional execution privileges or user interaction are required.

Q: What is the expected impact of successful exploitation?

Successful exploitation can cause a remote denial of service in the modem. The provided severity vector indicates no confidentiality or integrity impact.

Q: Are devices affected without a user taking action?

Yes. Exploitation does not require user interaction, but it depends on the device connecting to an attacker-controlled rogue base station.

Q: What identifiers can be used to track the fix?

The patch is identified as MOLY01876664, and the associated issue ID is MSV-9834.

Published Nov 1, 2026

Updated

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876664; Issue ID: MSV-9834.

Affected Software

2 affected componentsFixes available

android/:unknown:>=SoCVersion:0<SoCVersion:2026-11-05

SoCVersion:2026-11-05

Google Android

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Nov 2, 2026

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityAffected Software

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must operate or control a rogue base station and have a UE connect to it. No additional execution privileges or user interaction are required.

What is the expected impact of successful exploitation?

Successful exploitation can cause a remote denial of service in the modem. The provided severity vector indicates no confidentiality or integrity impact.

Are devices affected without a user taking action?

Yes. Exploitation does not require user interaction, but it depends on the device connecting to an attacker-controlled rogue base station.

What identifiers can be used to track the fix?

The patch is identified as MOLY01876664, and the associated issue ID is MSV-9834.

CVE-2026-20555: Medium severity Google Android vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the expected impact of successful exploitation?

Are devices affected without a user taking action?

What identifiers can be used to track the fix?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the expected impact of successful exploitation?

Are devices affected without a user taking action?

What identifiers can be used to track the fix?