VoLTE Video Call Vulnerability Grants Kernel Access on Unisoc Android Chips
Researchers from SSD Secure Disclosure have published a two-stage attack chain that allows an attacker to obtain access to the Android kernel through the modem firmware of Unisoc chipsets.
The attack starts with a remote code execution vulnerability in the modem that was discovered in March 2026. A specially crafted VoLTE video call can execute arbitrary code on the modem. A subsequent privilege-escalation flaw then reconfigures memory protection and reaches the memory regions used by the Android kernel.
The root cause is the absence of hardware isolation between the modem and application processor in Unisoc system-on-chips. Because the two processors share the same physical memory, code already running in the modem context can modify memory protections and access kernel areas.
The researchers confirmed successful execution of their payload by observing messages in the system log. The vulnerable firmware is used in at least three chipset families: T606, T612 and T7250. These chips are found in devices including the Motorola E13, Realme C33 and Xiaomi Redmi A5.
Exploitation requires control of a private 4G network and VoLTE infrastructure; the victim must also answer the incoming video call. The scenario is therefore not considered mass-exploitable from the public mobile network.
No fix has been released by Unisoc, and no CVE identifier has been assigned. The August Android security bulletin does not address the problem. SSD Secure Disclosure stated that multiple contact attempts via email and LinkedIn received no response from the chip vendor.
Related articles
Citrix Issues Critical XenServer Patches for Host Compromise Vulnerabilities
Citrix published security bulletin CTX697256 on November 3, 2026, disclosing eight vulnerabilities affecting XenServer. The most severe issue, tracked as CVE-2026-98432 and rated critical, enables an unauthenticated attacker who reaches the management network to compromise the virtualization host and associated appliances. A second flaw, CVE-2026-102703, allows a privileged user inside a guest virtual machine to break out and take control of the underlying host, violating isolation guarantees. Six additional vulnerabilities impact network boot and secure boot processes, potentially allowing attackers to compromise VMs during startup or bypass code-signing policies. Affected products include XenServer 8.4 and 9 along with Workload Balancing and Conversion Manager appliances. Citrix recommends immediate application of the fixes and temporary isolation of the management network while updates are deployed.
Microsoft Paint Patch for CVE-2026-83844 Fails to Reach Some Windows 11 Users via Microsoft Store
Microsoft fixed a remote code execution vulnerability in the Paint application for Windows 11, but the update is not reaching all users through the Microsoft Store. The flaw, tracked as CVE-2026-83844, carries a CVSS score of 8.1 and involves an out-of-bounds memory read that could allow unauthenticated network attacks. Although exploitation is rated as highly complex, the issue is classified as important by Microsoft. The patch is delivered separately from Windows Update, requiring users to verify the Paint version manually in the Microsoft Store. The clean version is listed as 11.2609.401.0, yet multiple systems remain on 11.2603.251.0 despite automatic updates being enabled. Windows Latest reported the distribution problem after checking its own systems and collecting similar reports from administrators. No real-world exploitation of the vulnerability has been observed so far.
Mozilla Releases Firefox 159.0.1 to Patch High-Severity Layout Vulnerability CVE-2026-120572
Mozilla Foundation has issued Firefox 159.0.1 to address a high-severity vulnerability tracked as CVE-2026-120572. The flaw resides in the Layout: Block and Inline component responsible for web page rendering. It stems from improper handling of boundary conditions during layout processing. CISA assigned the issue a CVSSv3.1 base score of 8.8, confirming high impact. The update was published on November 3, 2026, and is rated high severity by both Mozilla and CISA. Users are advised to apply the patch immediately to mitigate potential exploitation risks.
WatchGuard AuthPoint Authentication Gateway Hit by Four Critical Vulnerabilities
WatchGuard disclosed four security advisories for its AuthPoint multi-factor authentication solution on November 4, 2026. Three of the issues received a Critical rating while one was rated High. The flaws reside in the AuthPoint Authentication Gateway component and affect environments integrated with LDAP and Active Directory. CVE-2026-121639 allows unauthenticated attackers to disrupt authentication services or delete directory synchronization settings over the network. The remaining three vulnerabilities enable man-in-the-middle attacks, capture-replay actions, and forged authentication results. No exploitation in the wild has been observed. WatchGuard has released updated versions to address all reported issues.