CVE-2026-66086: Stack-based Buffer Overflow in Modem
In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker able to send or influence SIB1 scheduling information received by the affected modem OTA stack could exploit it remotely. No prior privileges or user interaction are required.
What is the potential impact?
Successful exploitation could cause denial of service or remote code execution, with high impact to confidentiality, integrity, and availability.
What should be prioritized for mitigation?
Prioritize applying vendor-provided remediation for devices using the affected modem OTA stack, particularly where devices may receive attacker-controlled cellular broadcast information. The provided data does not describe a workaround or configuration-based mitigation.