Unisoc VoLTE Exploit Chain Grants Full Android Kernel Access via Video Calls
Researchers have detailed a two-stage exploit chain targeting Unisoc modem firmware, allowing attackers to gain full Android kernel access through a VoLTE video call, with no patch currently available.
Independent security researchers have uncovered a critical two-stage exploit chain that allows attackers to achieve complete control over the Android kernel on devices equipped with Unisoc modem firmware. The attack leverages Voice over LTE (VoLTE) video calls, requiring the attacker to control a private 4G cellular network and the victim to accept the incoming call. This vulnerability chain builds upon a previously disclosed remote code execution (RCE) flaw, with no official patch or mitigation currently provided by Unisoc.
The initial stage of the exploit, disclosed in March 2026, involved a remote code execution vulnerability triggered by a malformed SIP video call. The newly detailed second stage, published on August 17, 2026, escalates this access to full kernel-level privileges. The privilege escalation is classified under CWE-1189, Improper Isolation of Shared Resources on System-on-a-Chip, and no specific CVE identifier has been assigned as of this report.
This critical flaw affects multiple Unisoc chipsets, including the T606 found in the Motorola E13, the T612 in the Realme C33, and the T7250 in the Xiaomi Redmi A5. Unisoc, a major supplier of mobile chipsets to global brands, has not responded to multiple attempts by researchers to contact them regarding this vulnerability. The exploit has been confirmed on devices with recent security patches, indicating that the vulnerability lies deep within the modem firmware.
To execute the full exploit chain, an attacker must first achieve a modem-level foothold via the March 2026 RCE vulnerability. Subsequently, they need to establish a controlled VoLTE infrastructure and trick a victim into answering a video call. The researchers successfully demonstrated a proof-of-concept by setting up a private 4G core network and using specialized SIM cards, highlighting the feasibility of such an attack.
Once code execution is achieved on the modem, the privilege escalation occurs by manipulating the modem's ARM Memory Protection Unit (MPU) through coprocessor registers. This allows the attacker to map the entire 32-bit physical address space as accessible, including the memory regions occupied by the Android kernel. This is possible due to a shared physical memory space between the modem and application processors on the Unisoc SoC, lacking hardware-level isolation.
The researchers confirmed kernel-level code execution by observing kernel log output from an injected payload on a test device. Notably, the August 2026 Android Security Bulletin does not list this vulnerability, nor has Unisoc released any advisory addressing it. A separate Unisoc advisory from October 2025 (CVE-2025-31718) describes a different modem input-validation flaw, but its relation to this exploit chain is unclear.
Device owners are currently left without a patch or immediate mitigation and are advised to await firmware updates from their respective device manufacturers. This discovery echoes previous research from Kaspersky ICS CERT, which identified a similar architectural weakness in other Unisoc chips, enabling kernel modification via shared memory spaces. While the MPU manipulation is theoretically patchable via firmware, Unisoc has not committed to a fix.
The lack of a timely response from Unisoc stands in contrast to past coordinated disclosures, such as CVE-2022-20210, which was patched by the vendor. The current situation leaves millions of devices vulnerable to sophisticated attacks that can compromise the entire operating system, underscoring the critical need for prompt vendor engagement and security updates.