# CVE-2026-0136: Google Pixel Modem out-of-bounds read causing remote DoS

Source: https://junglewise.ai/threats/cve-2026-0136-google-pixel-modem-out-of-bounds-read-causing-remote-dos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-16. Updated: 2026-06-16  
License: CC BY 4.0 with a link back

CVE-2026-0136 · Severity: info · CVSS 7.5 · Published 2026-06-16

A vulnerability exists in the modem component of Google Pixel devices that could allow a remote attacker to crash the device's cellular connectivity. This issue occurs because the modem fails to properly check the size of incoming data, leading to a denial-of-service condition. An exploit could disrupt mobile communications and data services without any interaction from the user.

Technologies: [Google Pixel Modem](https://junglewise.ai/threats/technologies/pixel-modem). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-0136 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0136 being exploited in the wild.

**How severe is CVE-2026-0136?** Informational severity, with a CVSS score of 7.5, published 16 June 2026.

**Which products and versions are affected?** Google Pixel Modem Devices prior to June 2026 patch level.

**Is there a fix for CVE-2026-0136?** A patch was published on 2026-06-05: Security patch level date for fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0136 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-0136?** Check whether you run Google Pixel Modem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the Modem firmware of Google Pixel devices. The flaw is caused by a missing bounds check during the processing of incoming data, which can be triggered remotely. An attacker can exploit this to cause a denial-of-service (DoS) condition, effectively disabling the modem's functionality. The attack requires no special privileges and no user interaction. Google addressed this vulnerability in the June 2026 Pixel Security Bulletin.

## Affected products

- Google Pixel Modem Devices prior to June 2026 patch level

## Timeline

- 2026-06-16: advisory: NVD and Google Pixel Security Bulletin published
- 2026-06-05: patched: Security patch level date for fix

## References

- [https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01](https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01)

## Related threats

- [Google Pixel Modem out-of-bounds write RCE](https://junglewise.ai/threats/cve-2026-0164-google-pixel-modem-out-of-bounds-write-rce)
- [Google Pixel Modem memory corruption in SIP REFER request](https://junglewise.ai/threats/cve-2026-0154-google-pixel-modem-memory-corruption-in-sip-refer-request)
- [Google Pixel Modem out-of-bounds write remote code execution](https://junglewise.ai/threats/cve-2026-0139-google-pixel-modem-out-of-bounds-write-remote-code-execution)
- [Google Pixel Modem out-of-bounds read leading to RCE](https://junglewise.ai/threats/cve-2026-0135-google-pixel-modem-out-of-bounds-read-leading-to-rce)
- [Google Pixel Modem heap buffer overflow RCE](https://junglewise.ai/threats/cve-2026-0132-google-pixel-modem-heap-buffer-overflow-rce)