CVE-2026-66086

Summary

A stack-based buffer overflow exists in the modem's OTA update system due to inadequate validation of SIB1 scheduling information, potentially allowing remote code execution or denial of service without any privileges.

Exploitability

Exploitation is likely straightforward with no prerequisites needed, as the vulnerability occurs during OTA updates and requires only network access to trigger the malformed SIB1 message.

Blast radius

The impact could be widespread across all affected modems that process OTA updates, potentially affecting thousands of devices in the field that rely on cellular connectivity.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version is published in the description, so disable the modem's OTA update functionality until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.