Unisoc VoLTE Video Call Exploit Chain Grants Full Android Kernel Access
Unisoc VoLTE Video Call Exploit Chain Grants Full Android (TL-2026-2041), also tracked as UNISOC T612 RCE, is a critical-severity software vulnerability, first published 2026-08-17. It has no confirmed attribution, affects Unisoc T606 modem firmware, maps to 9 MITRE ATT&CK techniques (T1014, T1055, T1190), and is covered by 9 detection rules and 12 indicators of compromise.
Key facts for TL-2026-2041
- Threat ID
- TL-2026-2041
- Also known as
- UNISOC T612 RCE, UNISOC T612 LPE
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-17
- Last reviewed
- 2026-08-17
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- consumer electronics, mobile telecommunications
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Unisoc VoLTE Video Call Exploit Chain Grants Full Android
Malware and tooling: egg_hunter.s, exploit.py, shellcode_kernel.c, write_and_execute_code_template.s
A two-stage exploit chain, disclosed piecemeal by researcher 0x50594d with SSD Secure Disclosure in March and August 2026, lets an attacker who controls a private 4G/IMS network gain full Android kernel code execution on phones using Unisoc T606, T612, or T7250 modem firmware. A malformed SIP/SDP video call first triggers modem-context remote code execution via unbounded recursion in the SDP parser (CWE-674), then abuses the lack of a hardware-enforced memory boundary between modem and application processor (CWE-1189) to disable ARM MPU protections and patch kernel code. No CVE has been assigned and Unisoc has not responded to multiple disclosure attempts as of publication.
How Unisoc VoLTE Video Call Exploit Chain Grants Full Android works
SSD Secure Disclosure and independent researcher 0x50594d published a two-stage exploit chain against Unisoc T606, T612, and T7250 modem firmware, shared across budget Android handsets sold by Motorola, Xiaomi, and Realme in more than 140 countries. Stage 1, disclosed on 2026-03-11 as "UNISOC T612 RCE," achieves remote code execution inside the modem by exploiting an Uncontrolled Recursion bug (CWE-674) in the `_SDPDEC_AcapDecoder` function of the modem's SIP/SDP parser (dispatched via `SipHandler_AttrDecoder`, index 49). An attacker who has authenticated to an IMS network sends a SIP INVITE containing an SDP line with multiple consecutive `acap:1` attributes, which recurse without a depth limit and overflow the stack of the SIP-handling task, colliding with the `sblock_0_2` SRTP-fragmentation task's stack. A subsequent video call's SRTP fragmentation is required to reliably trigger the collision. Shellcode is smuggled in as 28-byte ARM Thumb fragments spaced 356 bytes apart across multiple SIP/SDP messages and an `crypto` attribute used for controlled stack data injection.
Stage 2, disclosed on 2026-08-17 as "UNISOC T612 LPE," escalates the modem-context RCE to full Android kernel access. The exploit reassembles a second, larger payload (fragments of 0x4b0 bytes spaced 0x1bc bytes apart) at address 0x8de00000 by scanning for marker bytes 0xfffe/0xaaef (an "egg hunter" technique), then issues ARM coprocessor 15 (CP15) instructions — `MCR p15, 0, r0, c6, c2, 0` to disable MPU region 0's base-address protection and `MCR p15, 0, r0, c6, c1, 4` (value 0x10b) to grant full read/write/execute on region 1 — mapping the entire 32-bit physical address space (0x00000000-0x100000000) as accessible from modem context. With that access the payload overwrites the kernel function `__arm64_compat_sys_vmsplice` (physical address 0x804f6b58) with attacker shellcode and patches `do_sys_open` (0x804adb00) with a branch trampoline, using the kernel's `__bss_stop` symbol (0x821640e0) as scratch space for a mutex. Any subsequent call to the hooked syscalls executes the injected kernel code; the researchers demonstrated this with a `printk`-based proof of kernel log output. The root cause is architectural: Unisoc SoCs share physical memory between the modem baseband processor and the application processor with no hardware-enforced isolation boundary (CWE-1189), so any modem-context RCE can be escalated to full kernel compromise.
The published proof-of-concept environment used a Docker-based Open5GS core network with a Kamailio SIP server to simulate the IMS network, a LimeSDR software-defined radio for the 4G radio interface, and programmable Osmocom sysmoISIM-SJA5-9FV USIM cards, with a custom Python/pwntools exploit script (`exploit.py`) handling 3GPP Milenage authentication and payload delivery. Researchers confirmed kernel-level code execution on a Realme C33 (T612, Android security update 2025-07-01), a Motorola E13 (T606, security patch level 2025-02-01), and a Xiaomi Redmi A5 (T7250, security patch level 2026-01-01) — spanning three current security patch levels and confirming the flaw is not a single-firmware regression. SSD states it attempted to reach Unisoc via both email and LinkedIn multiple times and received no response; no CVE has been assigned to either stage, no Unisoc Product Security Bulletin covers it, and the August 2026 Android Security Bulletin does not address it. Device owners currently have no available patch or workaround beyond avoiding video calls from unknown or untrusted networks.
This is not the first documented instance of the modem/application-processor isolation gap in Unisoc silicon. Unisoc's own CVE-2025-31718 bulletin (published 2025-10-01, CVSS 3.1 7.5) describes a related-sounding "possible system crash due to improper input validation" in the modem affecting a broader chipset list (T606, T612, T616, T750, T765, T760, T770, T820, S8000, T8300, T9300) across Android 13-16, though The Hacker News notes it is unclear whether this corresponds to the March 2026 RCE disclosure. CVE-2022-20210 (CVSS 3.1 9.8), patched via the June 2022 Android Security Bulletin, previously documented a Unisoc modem NAS-message parsing bug with similar remote-crash/RCE potential, showing the vendor has patched comparable issues before when routed through the Android Security Bulletin process — a channel this new chain has not gone through. Separately, Kaspersky's ICS CERT team published research in October 2024 (CVE-2024-39432, CVE-2024-39431) demonstrating that Direct Memory Access (DMA) peripherals on Unisoc SoCs can be manipulated to bypass Memory Protection Unit safeguards and reach the application processor from modem-adjacent contexts, explicitly drawing a parallel to Operation Triangulation-style baseband attacks. Together, these prior disclosures establish that Unisoc's modem/AP memory-isolation weaknesses are a recurring architectural pattern rather than a one-off bug, and that this specific VoLTE-triggered chain remains unpatched and unacknowledged as of 2026-08-17.
MITRE ATT&CK techniques used in TL-2026-2041
Defense Evasion
T1014 Rootkit; T1055 Process Injection; T1620 Reflective Code Loading
Initial Access
T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities
Reconnaissance
T1592 Gather Victim Host Information
defense-impairment
Affected products and versions in Unisoc VoLTE Video Call Exploit Chain Grants Full Android
- Unisoc — T606 modem firmware
Vulnerable versions: all versions as of 2026-08-17 - Unisoc — T612 modem firmware
Vulnerable versions: all versions as of 2026-08-17 - Unisoc — T7250 modem firmware
Vulnerable versions: all versions as of 2026-08-17 - Motorola — Moto E13 (Unisoc T606)
Vulnerable versions: security patch level 2025-02-01 - Xiaomi — Redmi A5 (Unisoc T7250)
Vulnerable versions: security patch level 2026-01-01 - Realme — C33 (Unisoc T612)
Vulnerable versions: Android security update 2025-07-01
Remediation for Unisoc VoLTE Video Call Exploit Chain Grants Full Android
Immediate actions
- No vendor patch or firmware update is available as of 2026-08-17; there is currently no way to fully remediate affected devices
- Users of Motorola E13, Xiaomi Redmi A5, Realme C33, and other Unisoc T606/T612/T7250-based devices should avoid answering unexpected video calls, particularly on unfamiliar or roaming networks
- Organizations issuing budget Unisoc-based Android devices to staff should flag them as having an unmitigated remote kernel-compromise vector pending vendor action
Workarounds
- Where the carrier/device allows, disable VoLTE/VoWiFi video calling to force fallback to circuit-switched voice and reduce exposure to the malformed SIP/SDP video-call trigger
Longer-term hardening
- Unisoc must implement a hardware-enforced memory boundary (e.g., IOMMU/SMMU-backed isolation) between the modem baseband processor and the application processor, per CWE-1189 guidance
- OEMs (Motorola, Xiaomi, Realme, and others shipping Unisoc T606/T612/T7250) should push a firmware update once Unisoc issues a fix and route it through the Android Security Bulletin as was done for CVE-2022-20210
- Monitor the Unisoc Product Security Bulletin and Android Security Bulletin for a fix addressing this exploit chain
Weaknesses (CWE) in Unisoc VoLTE Video Call Exploit Chain Grants Full Android
CWE-1189, CWE-674
Timeline of Unisoc VoLTE Video Call Exploit Chain Grants Full Android
- CVE-2022-20210, a prior Unisoc modem NAS-message parsing bug with remote crash/RCE potential, is disclosed and patched via the June 2022 Android Security Bulletin — establishing precedent that Unisoc modem RCE issues can be routed through Google's patch process.
- Kaspersky ICS CERT publishes research (CVE-2024-39432, CVE-2024-39431) showing DMA peripherals on Unisoc SoCs can be manipulated to bypass MPU protections and reach the application processor, drawing a parallel to Operation Triangulation-style baseband attacks.
- Realme C33 (Unisoc T612) ships its July 2025 Android security update — the patch level later confirmed still vulnerable to the Stage-1 RCE PoC.
- Unisoc publishes a Product Security Bulletin for CVE-2025-31718, a modem 'improper input validation' issue (CVSS 3.1 7.5) affecting T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300 across Android 13-16; unclear if related to the March 2026 RCE disclosure.
- SSD Secure Disclosure and researcher 0x50594d publish 'UNISOC T612 RCE': a malformed SIP INVITE with recursive SDP acap attributes triggers unbounded recursion (CWE-674) and stack overflow in the modem's SDP parser, achieving modem-context remote code execution.
- The Hacker News reports the full two-stage exploit chain; SSD confirms no CVE has been assigned to either stage, Unisoc has not responded to multiple disclosure attempts via email and LinkedIn, and no patch or mitigation is available to device owners.
- SSD Secure Disclosure and researcher 0x50594d publish 'UNISOC T612 LPE': the modem RCE is escalated to full Android kernel access by disabling ARM MPU protections via CP15 coprocessor registers (CWE-1189) and patching kernel functions __arm64_compat_sys_vmsplice and do_sys_open.
Sources cited for Unisoc VoLTE Video Call Exploit Chain Grants Full Android
- Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
- UNISOC T612 LPE
- UNISOC T612 RCE
- CVE-2025-31718 Detail
- Unisoc Product Security Bulletin — modem improper input validation
- CVE-2022-20210 Detail
- Android Security Bulletin—June 2022
- Kaspersky Identifies Security Flaws in Unisoc System-on-Chip, Enabling Remote Hijacking
- docker_open5gs — Open5GS Docker deployment used in the PoC IMS network
- CVE-2022-38694 Bootloader Unlock — referenced baseline in the LPE advisory
Threats related to Unisoc VoLTE Video Call Exploit Chain Grants Full Android
- Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to Full Android Kernel Access
- Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local Privilege Escalation to Root (CVE-2026-46331)
- PinTheft — Linux Kernel RDS Zerocopy FOLL_PIN Refcount Imbalance Chained With io_uring Fixed Buffers For Page-Cache Overwrite And Local Root (Public PoC, Arch Linux Default-Affected)
- CISA Adds Two Known Exploited Vulnerabilities to Catalog: Fortinet FortiOS Information Disclosure (CVE-2025-68686) and Arista VeloCloud Orchestrator OS Command Injection (CVE-2026-16812)
- Unauthenticated RCE in Motorola MR2600 Wi-Fi Router via Firmware Upload Validation Bypass (related: CVE-2024-23630, CVE-2022-34885)
- DirtyDecrypt / DirtyCBC — Linux Kernel rxgk Root LPE with Public PoC (CVE-2026-31635)
Detection coverage for TL-2026-2041
As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2041 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.