# Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to Full Android Kernel Access

> Independent researcher 0x50594d, working with SSD Secure Disclosure, chained two unpatched Unisoc baseband firmware flaws to escalate a March 2026 modem-level RCE (malformed VoLTE video-call SDP) into full Android kernel code execution by disabling ARM Memory Protection Unit isolation via modem coprocessor registers. No CVE or vendor patch exists for the privilege-escalation step, and Unisoc has not responded to disclosure outreach.

- **Published:** 2026-08-17T00:00:00Z
- **Last reviewed:** 2026-08-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2049
- **ID:** TL-2026-2049
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SSD Secure Disclosure published a two-stage exploit chain against Unisoc baseband firmware shared across the T606, T612, T616 and T7250 chipset family, used in budget Android phones from Motorola, Realme, and Xiaomi, with reporting also noting the chipset family's broader footprint in Honor, Samsung, and vivo devices across 140+ countries.

Stage 1 (disclosed 2026-03-11, "UNISOC T612 RCE") is a CWE-674 uncontrolled-recursion stack overflow in the modem's `_SDPDEC_AcapDecoder` SDP parser. An attacker who has registered as a UE on an IMS core network sends a SIP INVITE whose SDP body contains repeated `acap:1` attributes (`v=0` / `a=acap:1 acap:1 acap:1 [...]`); the decoder recurses without a depth limit, colliding the SIP task stack with the `sblock_0_2` task stack when the victim answers the resulting video call and SRTP packet fragmentation activates that task. This overwrites stack-resident function pointers, including the `SipHandler_AttrDecoder` handler-table entry at 0x8d0f25c0, and a PoC register write (`r1 = 0x8d0f270c`, value `0xdeadbeef`) confirms controlled corruption. ARM Thumb shellcode, split into 28-byte segments separated by 356-byte (`HOLE_BETWEEN_PARTS`) gaps to survive SIP message fragmentation, executes with modem-context privileges once the overwritten pointer is invoked.

Stage 2 (disclosed 2026-08-17, "UNISOC T612 LPE") is CWE-1189, improper isolation of shared resources on the SoC: because the modem and application processor share the same physical address space (0x00000000-0x100000000) with no hardware-enforced boundary, code already running in modem context can reconfigure ARM Memory Protection Unit region 0 via coprocessor 15 operations (`MOV r0,#0x0` / `MCR p15,0,r0,c6,c2,0` to clear the region's base, `DSB`, then `MOV r0,#0x10b` / `MCR p15,0,r0,c6,c1,4` to remap the full 32-bit address space read/write/execute, `ISB`/`DSB`). Delivery is via SIP REGISTER (rogue-IMS authentication), a REG-notification subscription, then an egg-hunter payload fragmented across five INVITE-delivered parts separated by 0x1bc-byte gaps and reassembled at 0x8de00000 using the 0xffeaef marker. A follow-up video call triggers egg-hunter execution, the MPU disable sequence, a kernel shellcode write into 0x804f6b58 inside `__arm64_compat_sys_vmsplice` (kernel base 0x80080000; a mutex/`__bss_stop` region at 0x821640e0 is also referenced by the PoC), and a branch trampoline installed at `do_sys_open` (0x804adb00) redirecting execution to the injected code -- achieving full Android kernel code execution confirmed via kernel log (`printk`) output.

Completing the full chain requires the attacker to control a private/rogue 4G IMS network (researchers used a Docker-based Open5GS core with a Kamailio SIP proxy, a Milenage-algorithm implementation for IMS/USIM authentication, a LimeSDR software-defined radio for over-the-air delivery, and Osmocom test USIMs) and the victim to answer an incoming video call -- no other user interaction is needed. Unisoc has not issued a security bulletin for the isolation flaw, the August 2026 Android Security Bulletin predates and does not cover it, and SSD states vendor outreach via email and LinkedIn went unanswered on both disclosures; Infosecurity Magazine reported its own outreach to Unisoc also went unanswered. Related prior research from Kaspersky ICS CERT (2025-11-20) found an architecturally identical modem/kernel memory-isolation gap, exploitable via the same shared-physical-address-space design pattern, on the related Unisoc UIS7862A SoC used in vehicle head units, underscoring that the flaw recurs across the Unisoc product line beyond phones.

## MITRE ATT&CK

- T1587.004 Develop Capabilities: Exploits
- T1588.002 Obtain Capabilities: Tool
- T1190 Exploit Public-Facing Application
- T1664 Exploitation for Initial Access
- T1203 Exploitation for Client Execution
- T1658 Exploitation for Client Execution
- T1685 Disable or Modify Tools
- T1601.001 Modify System Image: Patch System Image
- T1014 Rootkit

## Sources

- [Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access](https://thehackernews.com/2026/08/unisoc-volte-video-call-exploit-chain.html)
- [UNISOC Modem Flaw Enables Remote Code Execution via Video Calls](https://www.infosecurity-magazine.com/news/unisoc-modem-flaw-rce-calls/)
- [UNISOC T612 RCE - SSD Secure Disclosure](https://ssd-disclosure.com/unisoc-t612-rce/)
- [UNISOC T612 LPE - SSD Secure Disclosure](https://ssd-disclosure.com/unisoc-t612-lpe/)
- [God Mode On: Researchers run Doom on a vehicle's head unit after remotely attacking its modem](https://ics-cert.kaspersky.com/publications/reports/2025/11/20/god-mode-on-researchers-run-doom-on-a-vehicles-head-unit-after-remotely-attacking-its-modem/)
- [CVE-2025-31718 Detail (NVD)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-31718)
- [Unisoc Security Announcement (CVE-2025-31718)](https://www.unisoc.com/en/support/announcement/1976557615080263681)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2049