Unisoc VoLTE Video Call Exploit Chain Grants Full Android Kernel Access — Threadlinqs Intelligence
As of 2026-08-17, Unisoc VoLTE Video Call Exploit Chain Grants Full Android Kernel Access is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 12 indicators of compromise.
Threat ID: TL-2026-2041 · Severity: CRITICAL · Status: ACTIVE · Category: VULNERABILITY
A two-stage exploit chain, disclosed piecemeal by researcher 0x50594d with SSD Secure Disclosure in March and August 2026, lets an attacker who controls a private 4G/IMS network gain full Android
SSD Secure Disclosure and independent researcher 0x50594d published a two-stage exploit chain against Unisoc T606, T612, and T7250 modem firmware, shared across budget Android handsets sold by Motorola, Xiaomi, and Realme in more than 140 countries. Stage 1, disclosed on 2026-03-11 as "UNISOC T612 RCE," achieves remote code execution inside the modem by exploiting an Uncontrolled Recursion bug (CWE-674) in the `_SDPDEC_AcapDecoder` function of the modem's SIP/SDP parser (dispatched via `SipHandler_AttrDecoder`, index 49). An attacker who has authenticated to an IMS network sends a SIP INVITE containing an SDP line with multiple consecutive `acap:1` attributes, which recurse without a depth limit and overflow the stack of the SIP-handling task, colliding with the `sblock_0_2` SRTP-fragmentation task's stack. A subsequent video call's SRTP fragmentation is required to reliably trigger the collision. Shellcode is smuggled in as 28-byte ARM Thumb fragments spaced 356 bytes apart across multiple SIP/SDP messages and an `crypto` attribute used for controlled stack data injection.
Stage 2, disclosed on 2026-08-17 as "UNISOC T612 LPE," escalates the modem-context RCE to full Android kernel access. The exploit reassembles a second, larger payload (fragments of 0x4b0 bytes spaced 0x1bc bytes apart) at address 0x8de00000 by scanning for marker bytes 0xfffe/0xaaef (an "egg hunter" technique), then issues ARM coprocessor 15 (CP15) instructions — `MCR p15, 0, r0, c6, c2, 0` to disable MPU region 0's base-address protection and `MCR p15, 0, r0, c6, c1, 4` (value 0x10b) to grant full read/write/execute on region 1 — mapping the entire 32-bit physical address space (0x00000000-0x100000000) as accessible from modem context. With that access the payload overwrites the kernel function `__arm64_compat_sys_vmsplice` (physical address 0x804f6b58) with attacker shellcode and patches `do_sys_open` (0x804adb00) with a branch trampoline, using the kernel's `__bss_stop` symbol (0x821640e0) as scratch space for a mutex. Any subsequent call to the hooked syscalls executes the injected kernel code; the researchers demonstrated this with a `printk`-based proof of kernel log output. The root cause is architectural: Unisoc SoCs share physical memory between the modem baseband processor and the application processor with no hardware-enforced isolation boundary (CWE-1189), so any modem-context RCE can be escalated to full kernel compromise.
The published proof-of-concept environment used a Docker-based Open5GS core network with a Kamailio SIP server to simulate the IMS network, a LimeSDR software-defined radio for the 4G radio interface, and programmable Osmocom sysmoISIM-SJA5-9FV USIM cards, with a custom Python/pwntools exploit script (`exploit.py`) handling 3GPP Milenage authentication and payload delivery. Researchers confirmed kernel-level code execution on a Realme C33 (T612, Android security update 2025-07-01), a Motorola E13 (T606, security patch level 2025-02-01), and a Xiaomi Redmi A5 (T7250, security patch level 2026-01-01) — spanning three current security patch levels and confirming the flaw is not a single-firmware regression. SSD states it attempted to reach Unisoc via both email and LinkedIn multiple times and received no response; no CVE has been assigned to either stage, no Unisoc Product Security Bulletin covers it, and the August 2026 Android Security Bulletin does not address it. Device owners currently have no available patch or workaround beyond avoiding video calls from unknown or untrusted networks.
This is not the first documented instance of the modem/application-processor isolation gap in Unisoc silicon. Unisoc's own CVE-2025-31718 bulletin (published 2025-10-01, CVSS 3.1 7.5) describes a related-sounding "possible system crash due to improper input validation" in the modem affecting a broader chipset list (T606, T612, T616, T750, T765, T760, T770, T820, S8000, T8300, T9300) across Android 13-16, though The Hacker News notes it is
Weaknesses (CWE)
CWE-1189, CWE-674
Target sectors: consumer electronics, mobile telecommunications
Target regions: Global
Timeline
- CVE-2022-20210, a prior Unisoc modem NAS-message parsing bug with remote crash/RCE potential, is disclosed and patched via the June 2022 Android Security Bulletin — establishing precedent that Unisoc modem RCE issues can be routed through Google's patch process.
- Kaspersky ICS CERT publishes research (CVE-2024-39432, CVE-2024-39431) showing DMA peripherals on Unisoc SoCs can be manipulated to bypass MPU protections and reach the application processor, drawing a parallel to Operation Triangulation-style baseband attacks.
- Realme C33 (Unisoc T612) ships its July 2025 Android security update — the patch level later confirmed still vulnerable to the Stage-1 RCE PoC.
- Unisoc publishes a Product Security Bulletin for CVE-2025-31718, a modem 'improper input validation' issue (CVSS 3.1 7.5) affecting T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300 across Android 13-16; unclear if related to the March 2026 RCE disclosure.
- SSD Secure Disclosure and researcher 0x50594d publish 'UNISOC T612 RCE': a malformed SIP INVITE with recursive SDP acap attributes triggers unbounded recursion (CWE-674) and stack overflow in the modem's SDP parser, achieving modem-context remote code execution.
- SSD Secure Disclosure and researcher 0x50594d publish 'UNISOC T612 LPE': the modem RCE is escalated to full Android kernel access by disabling ARM MPU protections via CP15 coprocessor registers (CWE-1189) and patching kernel functions __arm64_compat_sys_vmsplice and do_sys_open.
- The Hacker News reports the full two-stage exploit chain; SSD confirms no CVE has been assigned to either stage, Unisoc has not responded to multiple disclosure attempts via email and LinkedIn, and no patch or mitigation is available to device owners.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 12 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1592, T1583, T1587, T1190, T1203, T1055, T1601, T1620, T1014
