CVE-2026-0159: Cellular Modem RCE Vulnerability

CVE-2026-0159 Overview

CVE-2026-0159 is an out-of-bounds write vulnerability in the Cellular Modem component addressed by the Android Security Bulletin for September 2026. The flaw stems from a missing bounds check during modem message processing. Attackers can exploit it remotely without user interaction and without additional execution privileges. Successful exploitation leads to remote code execution within the modem context. The weakness is classified as [CWE-787] Out-of-bounds Write.

Critical Impact
Remote attackers can trigger memory corruption in the cellular modem and achieve remote code execution without user interaction, potentially compromising baseband functionality and adjacent device components.

Affected Products

Android devices incorporating the affected Cellular Modem component
Google Pixel devices covered by the September 2026 Pixel Security Bulletin
Downstream OEM firmware images that integrate the vulnerable baseband

Discovery Timeline

2026-09-15 - CVE-2026-0159 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database
Reference: Android Security Bulletin September 2026

Technical Details for CVE-2026-0159

Vulnerability Analysis

The vulnerability is an out-of-bounds write in the Cellular Modem firmware. A missing bounds check allows attacker-controlled data to overflow the boundaries of an intended memory region. The write occurs during processing of network-delivered modem traffic. Because the modem operates below the application processor, corruption at this layer can influence baseband state, call handling, and inter-processor communication. The [CWE-787] classification indicates memory corruption suitable for control-flow hijack when combined with a viable write primitive.

Root Cause

The root cause is the absence of length or index validation on an attacker-influenced field before a memory write operation in the modem firmware. Input from the cellular network is trusted beyond its safe range, permitting writes past the destination buffer. Missing bounds enforcement in baseband parsers is a recurring class of defect in cellular stacks.

Attack Vector

The attack vector is network-based and requires no user interaction. An adversary within radio range or operating a rogue base station can transmit crafted signaling messages that reach the vulnerable modem parser. The CVSS vector indicates low privileges are required on the attacker's side, and successful exploitation yields high impact to confidentiality, integrity, and availability. No public proof-of-concept or exploit code is currently listed for CVE-2026-0159, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are limited by vendor disclosure practice; refer to the Android Security Bulletin September 2026 for component-level details.

Detection Methods for CVE-2026-0159

Indicators of Compromise

Unexpected modem resets, radio interface layer (RIL) crashes, or repeated baseband reboots recorded in device logs
Anomalous cellular signaling patterns or unsolicited connections to unknown base stations
Devices reporting the pre-September 2026 security patch level after fleet update windows should have completed

Detection Strategies

Inventory Android and Pixel devices and compare reported ro.build.version.security_patch values against the September 2026 patch level
Correlate mobile device management (MDM) telemetry with vendor bulletin data to flag devices still running vulnerable baseband builds
Monitor endpoint and mobile threat defense feeds for indicators tied to rogue base station activity or abnormal cellular protocol behavior

Monitoring Recommendations

Enable continuous patch-level compliance reporting through your MDM or unified endpoint management platform
Alert on devices that fail to receive the September 2026 or later security update within defined SLA windows
Track vendor advisories from Google and OEMs for updates or expanded impact statements tied to CVE-2026-0159

How to Mitigate CVE-2026-0159

Immediate Actions Required

Apply the September 2026 Android security update, or later, to all affected devices as soon as OEM builds are available
Prioritize patch deployment for high-risk users, executives, and devices operating in untrusted radio environments
Validate patch level post-update and quarantine devices that cannot be updated within policy timelines

Patch Information

Google addressed CVE-2026-0159 in the September 2026 Android and Pixel security updates. Devices reporting a security patch level of 2026-09-01 or later include the fix for this Cellular Modem issue. OEM release schedules vary; consult vendor advisories for device-specific availability. Full details are available in the Android Security Bulletin September 2026.

Workarounds

Disable cellular radios or enable airplane mode on unpatched high-risk devices when connectivity is not required
Restrict use of unpatched devices to trusted Wi-Fi networks until the September 2026 update is applied
Enforce MDM policies that block activation of devices below the required security patch level

bash

# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-09-01 or later