CVE-2026-4967 Overview
CVE-2026-4967 is an out-of-bounds read vulnerability in the IP Multimedia Subsystem (IMS) component. A missing bounds check allows a remote attacker to trigger a denial-of-service condition without requiring authentication, user interaction, or elevated privileges. The issue is documented in the Unisoc Security Bulletin, which tracks vulnerabilities affecting Unisoc baseband and modem software widely deployed in mobile devices.
The vulnerability affects availability only. Confidentiality and integrity remain intact, but a successful attack can crash the IMS service and disrupt voice-over-LTE (VoLTE), voice-over-Wi-Fi, and related signaling functions on affected handsets.
Critical Impact
Remote attackers can trigger a denial-of-service in the IMS service without authentication or user interaction, disrupting mobile voice and messaging services on affected devices.
Affected Products
- Unisoc chipset platforms implementing the vulnerable IMS component
- Mobile devices using affected Unisoc baseband firmware
- Refer to the Unisoc Security Bulletin for the authoritative list of impacted models and firmware builds
Discovery Timeline
- 2026-07-03 - CVE-2026-4967 published to the National Vulnerability Database
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-4967
Vulnerability Analysis
The flaw is an out-of-bounds read [CWE-125] triggered by a missing bounds check in the IMS component. IMS handles signaling for VoLTE, VoWiFi, and related multimedia services, so parsing routines process externally supplied protocol messages such as SIP and SDP payloads. When a length or offset field is not validated against the actual buffer size, the parser reads memory beyond the allocated region.
Because the vulnerable code path is reachable over the network and the attack complexity is low, an attacker can send a crafted message to a targeted device to force the IMS service into an inconsistent state or crash. The result is a loss of availability for voice and messaging services that depend on IMS.
Exploitation does not yield code execution or memory disclosure to the attacker in a controllable form. The impact is limited to denial-of-service, consistent with the assessed availability-only impact.
Root Cause
The root cause is the absence of a length or offset validation prior to reading from a buffer inside the IMS message-handling logic. Attacker-controlled fields govern the read index, and no sanity check constrains the value to the allocated size. When the field is set to a value that exceeds the buffer, the read touches unmapped or unintended memory and destabilizes the process.
Attack Vector
The attack vector is network based. An attacker sends a malformed IMS signaling message to the target device over the mobile network or an interconnected IP path that reaches the IMS stack. No prior authentication or user interaction is required. Repeated or single crafted packets are sufficient to interrupt the IMS service and its dependent features.
No verified proof-of-concept code is publicly available for CVE-2026-4967. See the Unisoc Security Bulletin for vendor-supplied technical details.
Detection Methods for CVE-2026-4967
Indicators of Compromise
- Repeated crashes or restarts of the IMS service or baseband subsystem on affected devices
- Sudden and unexplained loss of VoLTE, VoWiFi, or SMS-over-IMS functionality for individual subscribers
- Malformed SIP or SDP messages observed on IMS signaling interfaces from untrusted peers
Detection Strategies
- Monitor carrier-side IMS core logs for parser errors, abnormal disconnects, or client re-registration storms tied to specific device fingerprints
- Inspect SIP traffic at session border controllers for oversized or malformed header and body fields inconsistent with RFC 3261
- Correlate device-side crash telemetry with signaling anomalies to identify targeted or opportunistic exploitation attempts
Monitoring Recommendations
- Enable rate limiting and anomaly detection on IMS signaling ingress points
- Aggregate mobile device crash reports into centralized logging to identify clusters of IMS failures
- Track vendor advisories from Unisoc and downstream device manufacturers for updated firmware release notes
How to Mitigate CVE-2026-4967
Immediate Actions Required
- Review the Unisoc Security Bulletin and identify affected chipsets in your fleet
- Coordinate with device manufacturers and mobile carriers to schedule firmware updates that include the IMS bounds-check fix
- Apply signaling filtering at session border controllers to drop malformed SIP or SDP messages before they reach subscriber devices
Patch Information
Unisoc has addressed the missing bounds check in the IMS component. Fixed firmware is distributed through device OEMs and mobile carriers. Consult the Unisoc Security Bulletin for the specific patch level that resolves CVE-2026-4967 and align device firmware baselines accordingly.
Workarounds
- Disable VoLTE or VoWiFi on affected devices where operationally acceptable until patches are applied
- Enforce strict SIP message validation and size limits at the IMS core and SBC layer
- Restrict IMS signaling exposure to trusted interconnect peers and apply network-level filtering for anomalous message patterns
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
