Security researchers at **SSD Secure Disclosure** have published details of a two-stage exploit chain that achieves full Android kernel access on Android devices running specific **Unisoc** modem firmware. The exploit leverages a **VoLTE** video call, with no fix yet available from the chipset manufacturer. ### The Exploit Chain: From RCE to Kernel Access The advisory, published on August 17, 2026, details the second stage of a complex attack. This follows an initial disclosure in March 2026, where SSD revealed remote code execution (**RCE**) capabilities in the same firmware via a malformed **SIP** video call. To execute the full chain, an attacker must control a private 4G cellular network and the victim must answer the incoming video call. ### Vendor Silence Persists **SSD Secure Disclosure** has stated they have attempted to contact **Unisoc** through multiple channels, including email and **LinkedIn**, but have received no response. This mirrors the situation following their March 2026 disclosure, raising significant concerns about vendor responsibility and user safety. The research was conducted by independent security researcher 0x50594d. ### Technical Details of the Vulnerability The privilege-escalation vulnerability is categorized as **CWE-1189**, "Improper Isolation of Shared Resources on System-on-a-Chip." As of publication, no **CVE** identifier has been assigned. The flaw affects modem firmware shared by at least three **Unisoc** chipsets: the **T606** (found in the **Motorola E13**), the **T612** (in the **Realme C33**), and the **T7250** (in the **Xiaomi Redmi A5**). **Unisoc**, formerly **Spreadtrum**, is a Shanghai-based chipmaker supplying components to major brands like **Motorola**, **Realme**, and **Xiaomi** for devices sold in over 140 countries. Researchers successfully confirmed the privilege-escalation flaw on a **Motorola E13** with a February 2025 security patch and a **Xiaomi Redmi A5** with a January 2026 patch. ### Execution and Impact Executing the complete chain requires an initial modem-level foothold from the March 2026 **RCE** vulnerability, combined with attacker-controlled **VoLTE** infrastructure and a victim answering the video call. The researchers constructed their proof-of-concept using an open-source 4G core network, a software-defined radio for the 4G interface, and specialized **SIM** cards. Once code runs on the modem, the privilege escalation works by writing a full-access configuration to the modem's **ARM Memory Protection Unit** (**MPU**) via coprocessor registers. This maps the entire 32-bit physical address space as readable, writable, and executable from the modem's context, critically including the pages where the Android kernel resides. The underlying condition enabling this is a shared physical memory space between the modem processor and the application processor within the **Unisoc SoC**, lacking hardware-enforced boundaries to prevent modem-context code from modifying kernel memory. Kernel-level code execution was confirmed by observing kernel log output indicating the injected payload had run. ### Lack of Patch and Mitigation The August 2026 Android Security Bulletin, released prior to this disclosure, does not address this privilege-escalation vulnerability, nor has **Unisoc** issued a security bulletin covering it. While a separate **Unisoc** advisory from October 2025, **CVE-2025-31718** (CVSS score: 7.5), describes a modem input-validation flaw on the same chipset family, it is unclear if it relates to the March 2026 **SSD** disclosure. Currently, device owners have no available patch or mitigation and must await a firmware update from their device manufacturer. ### Parallels with Previous Research This disclosure follows independent research published in November 2025 by **Kaspersky ICS CERT**. Their findings documented the same architectural condition on a different **Unisoc** chip, the **UIS7862A**, found in vehicle head units. After achieving modem code execution through a separate vulnerability, the **Kaspersky** team also managed to access and modify the running Android kernel by exploiting the shared physical address space between the modem and application processor. **Kaspersky** noted that one of their lateral movement paths, involving a hidden **Direct Memory Access** (**DMA**) peripheral, was a hardware-level issue not fixable through a software update. The **MPU** route used in the **SSD** chain is, in principle, addressable via a firmware change, though **Unisoc** has not committed to such an update. It is worth noting that a coordinated **Unisoc** modem vulnerability, **CVE-2022-20210**, uncovered by **Check Point Research** in 2022, was patched by **Unisoc** and distributed through the Android Security Bulletin. The two currently disclosed vulnerabilities carry no such assurance.