Security researchers at SSD Secure Disclosure published an advisory on August 17, 2026 detailing a two-stage exploit chain against Unisoc modem firmware that can escalate from a single incoming VoLTE video call to full Android kernel access, with no patch currently available from Unisoc. The chain builds on a remote-code-execution bug SSD disclosed back in March 2026, triggered by malformed SDP data inside SIP video-call signaling, and adds a new local-privilege-escalation stage that disables memory protection on the modem's first protected region, granting unrestricted read and write access to physical memory and, from there, the ability to modify kernel code. Exploiting the full chain requires the attacker to control a private 4G network and get the target to answer a video call, which limits it to a targeted rather than mass-scale attack, but the underlying flaw affects any device using the vulnerable Unisoc modem firmware; researchers confirmed it on a Realme C33, a Xiaomi Redmi A5 running January 2026 patches, and a Motorola E13 on a February 2025 patch level. SSD says it has tried reaching Unisoc through email and LinkedIn without any response, leaving affected device owners with no mitigation beyond watching for a firmware update from their device manufacturer, which is itself dependent on Unisoc first shipping a fix upstream. For mobile developers and security teams, this is a useful illustration of how baseband and modem-level vulnerabilities sit outside the usual Android security patch cadence: Google's monthly bulletin covers the OS and many chipset components, but modem firmware fixes depend on the silicon vendor's own responsiveness, which here has been essentially nonexistent for five months.