CVE-2026-66086CWE-121

CVE-2026-66086

Critical · published October 12, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00455 · 38.5th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2026-10-12T06:16Z
References (1)
https://www.unisoc.com/en/support/product-security-bulletin/2109454821805424641 · [email protected]
EPSS history
Timeline
  • 13 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 12 OCT 01:28Z
    Stack-based Buffer Overflow in Modem
    cvelistv5
  • 12 OCT 01:28Z
    Stack-based Buffer Overflow in Modem
    cvelistv5