The vulnerability resides in the modem component where an attacker can send a crafted SIP REFER request that triggers a memory corruption, causing the modem to crash. This crash can be exploited to execute arbitrary code on the device with the same privileges as the running process, without requiring any privilege escalation. The weakness is a buffer overflow (CWE-120).

All Google Android devices that include a modem capable of processing SIP REFER requests are affected. No specific Android OS versions are listed in the CNA data; therefore any device that supports SIP on the modem is potentially vulnerable.

The CVSS score of 8.8 indicates a high impact vulnerability, while the EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attack that exploits the SIP REFER protocol without any user interaction. An attacker can send a malicious SIP REFER packet over the network to the device, causing the modem to crash and enabling remote code execution. Due to the lack of user interaction and the high severity, any impact assessment should assume that an attacker capable of sending SIP traffic can compromise the device.