# Zero-Click Video Call Exploit in Unisoc Modems

> An exploit chain combines two Unisoc modem flaws — VoLTE signaling parser and baseband memory allocator — enabling RCE with zero victim interaction.

**URL:** https://www.ciptadusa.com/blog/zero-click-video-call-unisoc-modem-20260818  
**Type:** blog  
**Author:** PT Cipta Dua Saudara  
**Category:** Application Security  
**Published:** 2026-08-18  
**Cover:** https://cdn-uagents.enitip.com/uploads/blog/2026-08/daily-appsec-20260818-014618.jpg  

## Article

An incoming video call — not from a known contact, not from a saved number. The Unisoc modem on the receiving device processes the signaling packet before the user has a chance to press anything. Two vulnerabilities chained in that process give an attacker code execution with zero user interaction.

## Summary

Security researchers disclosed an exploit chain combining two vulnerabilities in Unisoc modems — one in the VoLTE signaling parser and one in the baseband memory allocator — enabling remote code execution through a video call without any victim interaction.

## The Challenge

Unisoc (formerly Spreadtrum) supplies chipsets for hundreds of millions of budget devices across Asia, Africa, and Latin America. Their baseband modem handles cellular communication protocols at the lowest level — below Android, below the Linux kernel, in a layer invisible to any antivirus.

This is what makes baseband exploits different from application-level vulnerabilities. Code running on the baseband processor has direct radio interface access without sandboxing. No ASLR, no SELinux, no Play Protect can intervene.

**The two chained flaws:**

The first flaw sits in the VoLTE SIP signaling parser. The modem receives and processes a SIP INVITE for a video call before the UI displays an incoming call notification. A malformed SDP (Session Description Protocol) body in the INVITE triggers a buffer overflow in the parser — yielding a limited write primitive in baseband memory.

The second flaw resides in Unisoc's custom baseband memory allocator. The write primitive from the first flaw corrupts allocator metadata, producing an arbitrary write. From here, the attacker redirects execution flow to shellcode delivered in the same SDP payload.

The result: zero-click RCE. The victim doesn't need to answer the call. The modem processes the exploit during call setup — before the ring tone sounds.

## Implications

Hundreds of millions of devices run Unisoc chipsets, predominantly in the sub-$150 price segment. These devices typically receive security patches late or not at all. The patch supply chain from Unisoc to OEM to carrier to end user can take 6-12 months — if it arrives at all.

What makes this more severe: exploitation requires only the victim's phone number. No phishing link, no app installation, no interaction whatsoever. Even an unanswered video call is sufficient — because the exploit occurs at the signaling layer, not the media layer.

For organizations operating Unisoc devices in their fleet — particularly in IoT, point-of-sale, and enterprise mobile deployments in emerging markets — the realistic short-term mitigation is network-level filtering of malformed SIP packets at the VoLTE gateway, not relying on device-level patches that may never arrive.

## References

- [Video Call Exploit Chains Two Flaws in Unisoc Modems](https://www.darkreading.com/mobile-security/video-call-exploit-chains-two-flaws-unisoc-modems)
- [Unisoc Baseband Security Research — Google Project Zero](https://googleprojectzero.blogspot.com/)
- [3GPP VoLTE Security Specifications (TS 33.328)](https://www.3gpp.org/specifications)

---

*Markdown version of https://www.ciptadusa.com/blog/zero-click-video-call-unisoc-modem-20260818 — generated for AI agents and LLM crawlers.*