🕵️ RESEARCH & DEEP DIVES
- Unisoc VoLTE Exploit Chain Enables Full Android Kernel Access
Researchers demonstrated full Android kernel access through a Unisoc VoLTE video call exploit chain.- Affected devices use Unisoc modem firmware, including Motorola E13, Realme C33, and Xiaomi Redmi A5.
- Tested versions included Xiaomi Redmi A5 with the 2026-01-01 patch, Motorola E13 with the 2025-02-01 patch, and Realme C33 with the July 2025 update.
- A malformed SIP video call first enables code execution in the modem context.
- The exploit disables protections on MPU region 0, granting modem code read, write, and execute access across the 32-bit physical address space.
- Completing the chain requires attacker-controlled VoLTE infrastructure and a victim who answers the video call; no vendor fix was reported.
📎 Coverage: darkreading.com · 👁 via Dark Reading
🔓 CVEs & KEV
-
CVE-2026-71424 — CVSS 9.6 — Onyx AI Platform Critical OAuth Token Exposure (CVE-2026-71424)
-
CVE-2026-70495 — CVSS 8.8 — search-v2-operator Privilege Escalation to Cluster Admin
-
CVE-2026-9816 — CVSS 8.3 — Insufficient server-side validation of board member role fields permits privi...
-
CVE-2026-9859 — CVSS 6.5 — Mattermost Boards plugin didn’t enforce role-based authorization on board cha...
-
CVE-2026-10080 — CVSS 6.5 — Boards plugin panics on WebSocket command with non-string field typesMattermo...