CVE-2026-66086: CWE-121 in Unisoc (Shanghai) Technologies Co., Ltd. Modem
Description
CVE-2026-66086 is a high-severity stack-based buffer overflow vulnerability in the modem OTA stack of Unisoc (Shanghai) Technologies Co., Ltd. modems. It arises from improper validation of scheduling information in SIB1 messages. Exploitation could allow remote code execution or denial of service without requiring additional privileges or user interaction. The affected products include modem versions T8100, T9100, and UDX710. No vendor patch or remediation information is currently provided.
CVSS v3.1
Score 8.3high
Affected software
Unisoc (Shanghai) Technologies Co., Ltd.
Modem
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-66086) involves a stack-based buffer overflow (CWE-121) in the modem OTA stack of Unisoc modems due to improper validation of scheduling information contained in SIB1 messages. An attacker can exploit this flaw remotely to execute arbitrary code or cause a denial of service. The vulnerability affects specific modem versions T8100, T9100, and UDX710. The CVSS v3.1 base score is 8.3, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation can lead to remote code execution or denial of service on affected modems without requiring any privileges or user interaction. This could compromise device integrity and availability, potentially impacting communications relying on these modems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, consider monitoring for vendor updates and applying any recommended mitigations once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Unisoc
- Date Reserved
- 2026-07-24T02:05:12.603Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acc438d2cdf04f65652e334
Added to database: 10/12/2026, 02:18:53 UTC
Last enriched: 10/12/2026, 02:33:17 UTC
Last updated: 10/12/2026, 02:33:17 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.