Quick answers
- Is CVE-2026-0164 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-0164 being exploited in the wild.
- How severe is CVE-2026-0164?
- Informational severity, with a CVSS score of 9.8, published 16 June 2026.
- Which products and versions are affected?
- Google Pixel Modem Devices prior to 2026-06-05 patch level.
- Is there a fix for CVE-2026-0164?
- A patch was published on 2026-06-05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-0164 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-0164?
- Check whether you run Google Pixel Modem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A critical out-of-bounds write vulnerability exists in the Modem firmware of Google Pixel devices due to a missing bounds check during data processing. The flaw is reachable via the network stack, requiring no authentication or user interaction (Zero-click). Successful exploitation allows an attacker to achieve remote code execution (RCE) within the context of the modem processor. This vulnerability was addressed in the June 2026 Pixel Security Bulletin; users should update to the 2026-06-05 patch level or later.
Affected products
- Google Pixel Modem Devices prior to 2026-06-05 patch level
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory
- 2026-06-05: patched