CVE-2026-66086
Received Received - Intake

Stack-Based Buffer Overflow in Modem OTA Stack

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Unisoc

Description
In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-66086
EUVD
EUVD-2026-97142

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Unisoc (Shanghai) Technologies Co., Ltd. Modem T8100
Unisoc (Shanghai) Technologies Co., Ltd. Modem T9100
Unisoc (Shanghai) Technologies Co., Ltd. Modem UDX710

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the modem OTA stack caused by improper validation of scheduling information in SIB1 messages. It allows remote attackers to execute arbitrary code or cause a denial of service without needing additional privileges.

Impact Analysis

This vulnerability could allow an attacker to remotely execute code on your device or crash it, potentially leading to unauthorized access, data theft, or service disruption. It requires no user interaction or special permissions to exploit.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for sensitive health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Apply patches or updates provided by Unisoc for the affected modem OTA stack. Monitor for SIB1 message anomalies in network traffic. Disable unnecessary modem features if patches are unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66086. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart