UNISOC VoLTE video-call exploit: what the research actually shows

A newly published UNISOC exploit chain is serious, but it is not as simple as an attacker placing an ordinary video call from anywhere. The demonstrated attack combines a flaw in the phone’s cellular modem with weak isolation between that modem and Android. It can end with code running at Android kernel level.

The practical qualifications matter. The researchers used their own 4G network and IMS platform, targeted particular UNISOC chipsets, and required the victim to answer a VoLTE video call. No vendor fix was available when the second stage was disclosed on 17 August 2026.

What has been demonstrated

The research describes two separate weaknesses that become much more damaging when joined together.

Stage	What happens	Why it matters
Modem compromise	Malformed session information in VoLTE signalling corrupts memory in the UNISOC modem firmware.	The attacker can move from cellular signalling to code execution inside the modem.
Android compromise	Code already running in the modem can alter memory protections and reach physical memory used by Android.	The chain can cross the boundary into the Android kernel, giving the attacker a much more powerful position.

The first stage is in the modem’s handling of Session Description Protocol (SDP) data carried in SIP signalling. SDP describes media sessions; it is the part of a call setup that says, among other things, what media is offered and how it should be carried. The defect allows deliberately repeated data to exhaust one task’s stack and overwrite adjacent control data.

The researchers then used the media flow associated with a video call to put the modem into the state needed for exploitation. That is why this is described as a VoLTE video-call attack. The call is the delivery path and trigger, not a fault in a consumer video-chat application.

The conditions an attacker would need

Those requirements make opportunistic attacks against the general public less likely. Building hostile cellular infrastructure is considerably harder than sending a malicious link or calling through a normal app. It is still achievable for a capable and determined operator, and the radio component can be placed near a target.

The disclosure names the UNISOC T606, T612, T616 and T7250 families in connection with the modem flaw. Testing cited a Realme C33 for the initial modem exploit, while the later kernel-access work also lists a Motorola E13 and Xiaomi Redmi A5. A model name alone is not enough to establish exposure: regional variants can use different chipsets and firmware builds.

Why the second stage changes the risk

A modem is a separate computer inside the phone. Compromising it is already serious because it handles cellular communications, but modern devices are supposed to restrict what it can do to the main application processor.

On the tested hardware, that separation was inadequate. The modem and Android side could reach the same physical memory, and modem code could reconfigure its Memory Protection Unit to make the full 32-bit address space readable, writable and executable. The researchers used that path to modify Android kernel memory and confirm that their payload ran.

This is not the first warning about that design pattern. Kaspersky researchers previously described crossing from a compromised modem into Android on a different UNISOC system-on-chip used in vehicle head units. The entry flaw was different, but the broader lesson was the same: a modem compromise becomes far worse when hardware boundaries do not contain it.

What device owners and administrators can do

There is no useful setting that repairs vulnerable modem firmware or missing hardware isolation. The immediate response is therefore about identifying exposure and reducing uncertainty.

• Check the exact device model, regional variant, chipset and current firmware rather than relying on the product family name.
• Install operating-system and baseband updates supplied by the device manufacturer and carrier.
• Ask the manufacturer whether its specific build contains the affected UNISOC modem code and whether a corrected baseband image is planned.
• For managed fleets, record chipset and baseband versions alongside the Android security-patch level. The Android date alone does not prove that modem firmware is current.
• Treat unexpected loss of cellular service, repeated modem restarts or unusual video-call behaviour as evidence worth preserving, not proof of this particular exploit.

Users at elevated risk can decline unexpected cellular video calls until their device supplier clarifies its status. That is a narrow precaution, not a complete mitigation: future work may find other ways to reach the same vulnerable parsing or isolation paths.

What this means for phone-system teams

This issue sits below a business PBX. A cloud PBX, SIP trunk or desk-phone configuration cannot patch a mobile baseband. It does, however, reinforce two operational points.

First, SIP and SDP are used beyond office VoIP. In VoLTE, they operate inside the carrier’s IMS environment, so faults in their parsers can affect the radio modem itself. Second, encrypted media does not make unsafe endpoint parsing harmless. Secure Real-time Transport Protocol (SRTP) protects media in transit; it does not correct a memory-safety defect in the device processing the session.

For background, see our guides to VoIP protocols, VoIP security and TLS and SRTP.

Our assessment

The disclosure is credible and technically consequential, but headlines can overstate its immediate reach. The researchers published detailed analysis and a working laboratory chain. They did not demonstrate that any caller on a normal public mobile service can compromise any Android phone by placing a video call.

The most concerning point is not the ringing phone. It is that code execution in one processor could escape its expected boundary and alter the main operating system. Device makers using the affected components need to identify vulnerable firmware, distribute fixes where software can contain the issue, and say clearly which products cannot be fully remediated.

Sources: SSD Secure Disclosure’s UNISOC modem RCE analysis and kernel privilege-escalation analysis; Kaspersky ICS CERT’s research on modem-to-Android compromise in a different UNISOC platform.