Out-of-Bounds Write in Cellular Modem Leads to Remote Code Execution

Executive Summary

CVE-2026-0159 is a high-severity Remote Code Execution (RCE) vulnerability in the Cellular Modem component of Pixel devices. It occurs due to a missing bounds check, allowing an out-of-bounds write that could lead to remote code execution without needing additional privileges or user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Modem component in Pixel devices and requires a security patch. Detection involves checking the device's security patch level and installed firmware version. Use the command 'adb shell getprop ro.build.version.security_patch' to verify if the patch level is 2026-09-05 or later. If not, the device is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to remotely execute arbitrary code on your Pixel device through the Modem component. Since no user interaction or extra privileges are required, it poses a significant risk if exploited. Google has not observed active exploitation but recommends updating to the latest security patch to mitigate potential risks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to remote code execution, potentially exposing sensitive user data. For GDPR, this may result in unauthorized access to personal data, triggering breach notification requirements. Under HIPAA, it could compromise protected health information if exploited on devices handling such data.

Useful 0 Not Useful 0

Mitigation Strategies

Update your Pixel device to the September 2026 security patch or later, which includes a fix for CVE-2026-0159. Ensure your device has a security patch level of 2026-09-05 or newer.

Useful 0 Not Useful 0