Unisoc VoLTE Video Call Exploit Chain Grants Full Android Kernel Access

Unisoc VoLTE Video Call Exploit Chain Grants Full Android (TL-2026-2041), also tracked as UNISOC T612 RCE, is a critical-severity software vulnerability, first published 2026-08-17. It has no confirmed attribution, affects Unisoc T606 modem firmware, maps to 9 MITRE ATT&CK techniques (T1014, T1055, T1190), and is covered by 9 detection rules and 12 indicators of compromise.

Key facts for TL-2026-2041

Threat ID
TL-2026-2041
Also known as
UNISOC T612 RCE, UNISOC T612 LPE
Severity
CRITICAL
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-17
Last reviewed
2026-08-17
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
consumer electronics, mobile telecommunications
Target regions
Global
Detection rules
9
Indicators of compromise
12

Malware and tooling in Unisoc VoLTE Video Call Exploit Chain Grants Full Android

Malware and tooling: egg_hunter.s, exploit.py, shellcode_kernel.c, write_and_execute_code_template.s

A two-stage exploit chain, disclosed piecemeal by researcher 0x50594d with SSD Secure Disclosure in March and August 2026, lets an attacker who controls a private 4G/IMS network gain full Android kernel code execution on phones using Unisoc T606, T612, or T7250 modem firmware. A malformed SIP/SDP video call first triggers modem-context remote code execution via unbounded recursion in the SDP parser (CWE-674), then abuses the lack of a hardware-enforced memory boundary between modem and application processor (CWE-1189) to disable ARM MPU protections and patch kernel code. No CVE has been assigned and Unisoc has not responded to multiple disclosure attempts as of publication.

How Unisoc VoLTE Video Call Exploit Chain Grants Full Android works

SSD Secure Disclosure and independent researcher 0x50594d published a two-stage exploit chain against Unisoc T606, T612, and T7250 modem firmware, shared across budget Android handsets sold by Motorola, Xiaomi, and Realme in more than 140 countries. Stage 1, disclosed on 2026-03-11 as "UNISOC T612 RCE," achieves remote code execution inside the modem by exploiting an Uncontrolled Recursion bug (CWE-674) in the `_SDPDEC_AcapDecoder` function of the modem's SIP/SDP parser (dispatched via `SipHandler_AttrDecoder`, index 49). An attacker who has authenticated to an IMS network sends a SIP INVITE containing an SDP line with multiple consecutive `acap:1` attributes, which recurse without a depth limit and overflow the stack of the SIP-handling task, colliding with the `sblock_0_2` SRTP-fragmentation task's stack. A subsequent video call's SRTP fragmentation is required to reliably trigger the collision. Shellcode is smuggled in as 28-byte ARM Thumb fragments spaced 356 bytes apart across multiple SIP/SDP messages and an `crypto` attribute used for controlled stack data injection.

Stage 2, disclosed on 2026-08-17 as "UNISOC T612 LPE," escalates the modem-context RCE to full Android kernel access. The exploit reassembles a second, larger payload (fragments of 0x4b0 bytes spaced 0x1bc bytes apart) at address 0x8de00000 by scanning for marker bytes 0xfffe/0xaaef (an "egg hunter" technique), then issues ARM coprocessor 15 (CP15) instructions — `MCR p15, 0, r0, c6, c2, 0` to disable MPU region 0's base-address protection and `MCR p15, 0, r0, c6, c1, 4` (value 0x10b) to grant full read/write/execute on region 1 — mapping the entire 32-bit physical address space (0x00000000-0x100000000) as accessible from modem context. With that access the payload overwrites the kernel function `__arm64_compat_sys_vmsplice` (physical address 0x804f6b58) with attacker shellcode and patches `do_sys_open` (0x804adb00) with a branch trampoline, using the kernel's `__bss_stop` symbol (0x821640e0) as scratch space for a mutex. Any subsequent call to the hooked syscalls executes the injected kernel code; the researchers demonstrated this with a `printk`-based proof of kernel log output. The root cause is architectural: Unisoc SoCs share physical memory between the modem baseband processor and the application processor with no hardware-enforced isolation boundary (CWE-1189), so any modem-context RCE can be escalated to full kernel compromise.

The published proof-of-concept environment used a Docker-based Open5GS core network with a Kamailio SIP server to simulate the IMS network, a LimeSDR software-defined radio for the 4G radio interface, and programmable Osmocom sysmoISIM-SJA5-9FV USIM cards, with a custom Python/pwntools exploit script (`exploit.py`) handling 3GPP Milenage authentication and payload delivery. Researchers confirmed kernel-level code execution on a Realme C33 (T612, Android security update 2025-07-01), a Motorola E13 (T606, security patch level 2025-02-01), and a Xiaomi Redmi A5 (T7250, security patch level 2026-01-01) — spanning three current security patch levels and confirming the flaw is not a single-firmware regression. SSD states it attempted to reach Unisoc via both email and LinkedIn multiple times and received no response; no CVE has been assigned to either stage, no Unisoc Product Security Bulletin covers it, and the August 2026 Android Security Bulletin does not address it. Device owners currently have no available patch or workaround beyond avoiding video calls from unknown or untrusted networks.

This is not the first documented instance of the modem/application-processor isolation gap in Unisoc silicon. Unisoc's own CVE-2025-31718 bulletin (published 2025-10-01, CVSS 3.1 7.5) describes a related-sounding "possible system crash due to improper input validation" in the modem affecting a broader chipset list (T606, T612, T616, T750, T765, T760, T770, T820, S8000, T8300, T9300) across Android 13-16, though The Hacker News notes it is unclear whether this corresponds to the March 2026 RCE disclosure. CVE-2022-20210 (CVSS 3.1 9.8), patched via the June 2022 Android Security Bulletin, previously documented a Unisoc modem NAS-message parsing bug with similar remote-crash/RCE potential, showing the vendor has patched comparable issues before when routed through the Android Security Bulletin process — a channel this new chain has not gone through. Separately, Kaspersky's ICS CERT team published research in October 2024 (CVE-2024-39432, CVE-2024-39431) demonstrating that Direct Memory Access (DMA) peripherals on Unisoc SoCs can be manipulated to bypass Memory Protection Unit safeguards and reach the application processor from modem-adjacent contexts, explicitly drawing a parallel to Operation Triangulation-style baseband attacks. Together, these prior disclosures establish that Unisoc's modem/AP memory-isolation weaknesses are a recurring architectural pattern rather than a one-off bug, and that this specific VoLTE-triggered chain remains unpatched and unacknowledged as of 2026-08-17.

MITRE ATT&CK techniques used in TL-2026-2041

Defense Evasion

T1014 Rootkit; T1055 Process Injection; T1620 Reflective Code Loading

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities

Reconnaissance

T1592 Gather Victim Host Information

defense-impairment

T1601 Modify System Image

Affected products and versions in Unisoc VoLTE Video Call Exploit Chain Grants Full Android

  • Unisoc — T606 modem firmware
    Vulnerable versions: all versions as of 2026-08-17
  • Unisoc — T612 modem firmware
    Vulnerable versions: all versions as of 2026-08-17
  • Unisoc — T7250 modem firmware
    Vulnerable versions: all versions as of 2026-08-17
  • Motorola — Moto E13 (Unisoc T606)
    Vulnerable versions: security patch level 2025-02-01
  • Xiaomi — Redmi A5 (Unisoc T7250)
    Vulnerable versions: security patch level 2026-01-01
  • Realme — C33 (Unisoc T612)
    Vulnerable versions: Android security update 2025-07-01

Remediation for Unisoc VoLTE Video Call Exploit Chain Grants Full Android

Immediate actions

  • No vendor patch or firmware update is available as of 2026-08-17; there is currently no way to fully remediate affected devices
  • Users of Motorola E13, Xiaomi Redmi A5, Realme C33, and other Unisoc T606/T612/T7250-based devices should avoid answering unexpected video calls, particularly on unfamiliar or roaming networks
  • Organizations issuing budget Unisoc-based Android devices to staff should flag them as having an unmitigated remote kernel-compromise vector pending vendor action

Workarounds

  • Where the carrier/device allows, disable VoLTE/VoWiFi video calling to force fallback to circuit-switched voice and reduce exposure to the malformed SIP/SDP video-call trigger

Longer-term hardening

  • Unisoc must implement a hardware-enforced memory boundary (e.g., IOMMU/SMMU-backed isolation) between the modem baseband processor and the application processor, per CWE-1189 guidance
  • OEMs (Motorola, Xiaomi, Realme, and others shipping Unisoc T606/T612/T7250) should push a firmware update once Unisoc issues a fix and route it through the Android Security Bulletin as was done for CVE-2022-20210
  • Monitor the Unisoc Product Security Bulletin and Android Security Bulletin for a fix addressing this exploit chain

Weaknesses (CWE) in Unisoc VoLTE Video Call Exploit Chain Grants Full Android

CWE-1189, CWE-674

Timeline of Unisoc VoLTE Video Call Exploit Chain Grants Full Android

  • CVE-2022-20210, a prior Unisoc modem NAS-message parsing bug with remote crash/RCE potential, is disclosed and patched via the June 2022 Android Security Bulletin — establishing precedent that Unisoc modem RCE issues can be routed through Google's patch process.
  • Kaspersky ICS CERT publishes research (CVE-2024-39432, CVE-2024-39431) showing DMA peripherals on Unisoc SoCs can be manipulated to bypass MPU protections and reach the application processor, drawing a parallel to Operation Triangulation-style baseband attacks.
  • Realme C33 (Unisoc T612) ships its July 2025 Android security update — the patch level later confirmed still vulnerable to the Stage-1 RCE PoC.
  • Unisoc publishes a Product Security Bulletin for CVE-2025-31718, a modem 'improper input validation' issue (CVSS 3.1 7.5) affecting T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300 across Android 13-16; unclear if related to the March 2026 RCE disclosure.
  • SSD Secure Disclosure and researcher 0x50594d publish 'UNISOC T612 RCE': a malformed SIP INVITE with recursive SDP acap attributes triggers unbounded recursion (CWE-674) and stack overflow in the modem's SDP parser, achieving modem-context remote code execution.
  • The Hacker News reports the full two-stage exploit chain; SSD confirms no CVE has been assigned to either stage, Unisoc has not responded to multiple disclosure attempts via email and LinkedIn, and no patch or mitigation is available to device owners.
  • SSD Secure Disclosure and researcher 0x50594d publish 'UNISOC T612 LPE': the modem RCE is escalated to full Android kernel access by disabling ARM MPU protections via CP15 coprocessor registers (CWE-1189) and patching kernel functions __arm64_compat_sys_vmsplice and do_sys_open.

Sources cited for Unisoc VoLTE Video Call Exploit Chain Grants Full Android

Threats related to Unisoc VoLTE Video Call Exploit Chain Grants Full Android

Detection coverage for TL-2026-2041

As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2041 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats