# CVE-2026-0164: Google Pixel Modem out-of-bounds write RCE

Source: https://junglewise.ai/threats/cve-2026-0164-google-pixel-modem-out-of-bounds-write-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-16. Updated: 2026-06-16  
License: CC BY 4.0 with a link back

CVE-2026-0164 · Severity: info · CVSS 9.8 · Published 2026-06-16

A critical security vulnerability has been identified in the modem component of Google Pixel devices. This component manages cellular connectivity, and a flaw in how it handles incoming data could allow a remote attacker to execute unauthorized code on the device. This attack can be carried out over the mobile network without any user interaction or special permissions, potentially compromising the entire device's security and data privacy.

Technologies: [Google Pixel Modem](https://junglewise.ai/threats/technologies/pixel-modem). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-0164 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0164 being exploited in the wild.

**How severe is CVE-2026-0164?** Informational severity, with a CVSS score of 9.8, published 16 June 2026.

**Which products and versions are affected?** Google Pixel Modem Devices prior to 2026-06-05 patch level.

**Is there a fix for CVE-2026-0164?** A patch was published on 2026-06-05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0164 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-0164?** Check whether you run Google Pixel Modem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A critical out-of-bounds write vulnerability exists in the Modem firmware of Google Pixel devices due to a missing bounds check during data processing. The flaw is reachable via the network stack, requiring no authentication or user interaction (Zero-click). Successful exploitation allows an attacker to achieve remote code execution (RCE) within the context of the modem processor. This vulnerability was addressed in the June 2026 Pixel Security Bulletin; users should update to the 2026-06-05 patch level or later.

## Affected products

- Google Pixel Modem Devices prior to 2026-06-05 patch level

## Timeline

- 2026-06-16: disclosed
- 2026-06-16: advisory
- 2026-06-05: patched

## References

- [https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01](https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01)

## Related threats

- [Google Pixel Modem memory corruption in SIP REFER request](https://junglewise.ai/threats/cve-2026-0154-google-pixel-modem-memory-corruption-in-sip-refer-request)
- [Google Pixel Modem out-of-bounds write remote code execution](https://junglewise.ai/threats/cve-2026-0139-google-pixel-modem-out-of-bounds-write-remote-code-execution)
- [Google Pixel Modem out-of-bounds read causing remote DoS](https://junglewise.ai/threats/cve-2026-0136-google-pixel-modem-out-of-bounds-read-causing-remote-dos)
- [Google Pixel Modem out-of-bounds read leading to RCE](https://junglewise.ai/threats/cve-2026-0135-google-pixel-modem-out-of-bounds-read-leading-to-rce)
- [Google Pixel Modem heap buffer overflow RCE](https://junglewise.ai/threats/cve-2026-0132-google-pixel-modem-heap-buffer-overflow-rce)