Security researchers from SSD Secure Disclosure have published details of a Unisoc VoLTE exploit chain that could allow an attacker to reach full Android kernel access on affected devices. The work describes a two-stage process tied to Unisoc modem firmware and, specifically, to VoLTE video calls—while also noting that no fix had been provided by the chipset vendor at the time of publication.
The advisory, dated August 17, 2026, extends earlier research. A first step was disclosed in March 2026 as a remote code execution issue related to malformed SIP video call handling. Completing the overall impact requires additional conditions: the attacker must control the right kind of cellular infrastructure and the victim must answer an incoming VoLTE video call.
What the Unisoc VoLTE exploit chain targets
The chain focuses on privilege escalation inside the modem firmware. According to SSD Secure Disclosure, the underlying vulnerability affects modem firmware shared by multiple Unisoc chipset models. The researchers list examples including the T606 used in the Motorola E13, the T612 used in the Realme C33, and the T7250 used in the Xiaomi Redmi A5.
Unisoc is described in the advisory as a Shanghai-based chipmaker, formerly known as Spreadtrum. The researchers also state that Unisoc components appear in devices sold across more than 140 countries, and they are used by brands such as Motorola, Realme, and Xiaomi.
Stage one: remote code execution via SIP video calls
The second-stage work builds on a March 2026 disclosure. In that earlier report, SSD Secure Disclosure described remote code execution in the same modem firmware family by abusing a malformed SIP video call.
To be clear, the August 2026 advisory is not presenting the initial entry point from scratch. Instead, it explains how the chain progresses after the attacker already achieved modem-level code execution via that earlier flaw.
SSD Secure Disclosure also notes that attempts to contact the vendor did not produce a response. The March 2026 advisory included the same statement, and the research was reportedly carried out by an independent researcher using the handle 0x50594d.
Stage two: turning modem control into Android kernel access
Once the attacker has modem-level execution from the March 2026 remote code execution vulnerability, the second stage focuses on privilege escalation. SSD Secure Disclosure classifies the privilege escalation issue as CWE-1189 (“Improper Isolation of Shared Resources on System-on-a-Chip”). Notably, the advisory states that no CVE identifier had been assigned as of publication for this privilege escalation step.
The key point is that the privilege escalation step can be used to write a full-access configuration into the modem’s ARM Memory Protection Unit using coprocessor registers. With that configuration, the process can map the entire 32-bit physical address space as readable, writable, and executable from the modem context.
Critically, that includes memory pages where the Android kernel resides. In other words, the attacker’s modem context is not effectively prevented from reaching and modifying kernel memory.
The architectural condition behind the impact
According to the researchers, this outcome is possible because of a shared physical memory space between the modem processor and the application processor within the Unisoc SoC. The researchers describe the absence of a hardware-enforced boundary that would stop modem-context code from modifying kernel memory.
SSD Secure Disclosure also describes how they confirmed kernel-level execution on a test device. They observed kernel log output indicating that the injected payload had run successfully.
Attack prerequisites: control, infrastructure, and user action
The chain does not work in a vacuum. SSD Secure Disclosure emphasizes that a complete exploitation requires multiple conditions to align:
- The attacker must already have achieved a modem-level foothold using the earlier remote code execution vulnerability.
- The attacker must control the private 4G cellular network and VoLTE infrastructure used to route and trigger the call flow.
- The victim must answer the incoming video call.
The researchers built their proof-of-concept setup using an open-source 4G core network, a software-defined radio for the 4G radio interface, and specialized SIM cards. This supports the idea that the attack is highly dependent on environment control rather than being a simple remote trigger.
Has Android been patched? Bulletin status and CVE context
SSD Secure Disclosure states that the August 2026 Android Security Bulletin (published before this disclosure) does not address the privilege escalation vulnerability. In addition, the researchers report that no Unisoc security bulletin covered the issue at the time of publication.
For affected device owners, the practical takeaway is straightforward: the advisory indicates there is currently no available patch or mitigation and recommends monitoring for firmware updates released by device manufacturers.
The report also references a separate Unisoc advisory from October 2025—CVE-2025-31718 with a CVSS score of 7.5—describing a modem input-validation problem affecting the same chipset family. However, SSD Secure Disclosure says it is not clear whether that October 2025 issue corresponds to the March 2026 disclosure.
Proof and confirmation on real devices
The researchers claim they confirmed the privilege escalation flaw on test devices representing different firmware patch levels:
- A Motorola E13 carrying a February 2025 security patch.
- A Xiaomi Redmi A5 carrying a January 2026 patch.
This suggests that the issue persisted across at least some patch timelines on devices using the relevant modem firmware family—again underscoring that a mitigation was not available via chipset fixes at the time.
Why this matters: shared-memory kernel reach
The most concerning aspect of the Unisoc VoLTE exploit chain is not just that the modem can run code, but that the modem execution context can extend into the Android kernel due to an isolation gap. Where many modem-to-host attacks are limited by security boundaries, this chain describes how those boundaries can fail when the modem’s memory protection configuration is manipulated.
Once an attacker reaches the kernel, the ceiling for what is possible changes dramatically. The researchers’ observations of kernel log output support that the impact can progress from “running code somewhere” to “executing in a position that the system typically relies on for core security and stability.”
Related research: Kaspersky and prior architectural findings
SSD Secure Disclosure also connects its findings to earlier independent work. The disclosure references research by Kaspersky ICS CERT published in November 2025, which documented a similar architectural condition on a different Unisoc chip: the UIS7862A, found in vehicle head units.
Kaspersky’s team described achieving modem code execution via another vulnerability and then reaching and modifying the running Android kernel by exploiting the same shared physical address space between modem and application processors. In that work, Kaspersky also noted a lateral movement path tied to a hidden DMA peripheral, described as a hardware-level issue not solvable with a software update.
SSD Secure Disclosure adds that the Memory Protection Unit route used in the August chain is in principle addressable through firmware changes, but that no such update had been committed by Unisoc at the time.
What device owners can do right now
If your device uses Unisoc modem firmware in the affected family, there is no immediate user-side patch described in the advisory. Still, you can take practical steps:
- Check for firmware and modem-related updates from your device manufacturer. The advisory encourages monitoring for updates.
- Stay current with Android security patches, even though this specific issue was not covered in the referenced August 2026 bulletin.
- Be cautious with VoLTE video calls, especially in environments where attackers could control the cellular infrastructure. The chain requires the victim to answer, so user interaction matters in practice.
Security researchers often emphasize that exploitation requires specific conditions—yet the consequences described here are severe enough that defenders should treat the underlying isolation weakness as a high-priority risk.
Conclusion
The Unisoc VoLTE exploit chain described by SSD Secure Disclosure outlines a rare but high-impact path from modem code execution to full Android kernel access. By abusing modem memory protection configuration and relying on shared physical address space inside the SoC, the attacker’s code can reach kernel memory—something researchers say was not effectively blocked by hardware-enforced isolation.
With no chipset fix available at publication and no coverage in the referenced Android security bulletin, the most reliable mitigation for end users remains waiting for and installing firmware updates from device makers. For security teams, the broader lesson is clear: when modem and application processors share memory without strong boundaries, privilege escalation can become a systemic issue rather than a contained bug.
Source: https://thehackernews.com/2026/08/unisoc-volte-video-call-exploit-chain.html
