CVE-2026-66085 Unisoc (Shanghai) Technologies Co., Ltd. CVE debrief

Who should care

Defenders responsible for inventory management, system administrators, and security teams should assess exposure and prioritize verification.

Why it matters

Defenders should care about CVE-2026-66085 because it could lead to local information disclosure with no additional execution privileges needed, particularly in systems where local access could lead to sensitive data exposure. Verification of inventory and exposure is necessary, and compensating controls should be implemented to monitor for potential information disclosure.

• Local information disclosure possible with no additional execution privileges needed
• Potential for sensitive data exposure in crash dumps
• Verification of inventory and exposure is necessary

Technical summary

The vulnerability is due to missing filtering of sensitive data in crash dumps in a modem. This could lead to local information disclosure with no additional execution privileges needed. The affected product context indicates that defenders should prioritize verifying the presence of this vulnerability in their inventory and assess exposure, particularly in systems where local access could lead to information disclosure.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assess exposure, particularly in systems where local access could lead to information disclosure.

Recommended defensive actions

• Verify the presence of this vulnerability in your inventory
• Assess exposure, particularly in systems where local access could lead to information disclosure
• Implement compensating controls to monitor for potential information disclosure

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Unisoc security bulletin is referenced but not provided. Evidence is limited to CVE Program and NVD details. Defenders should verify the presence of this vulnerability in their inventory and assess exposure, particularly in systems where local access could lead to information disclosure, with compensating controls to monitor for potential information disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.