A missing bounds check in Unisoc's IMS component causes an out‑of‑bounds read. The read can trigger a crash or abnormal reset without needing elevated privileges, resulting in a denial of service that can be triggered remotely.

Devices incorporating Unisoc (Shanghai) Technologies SoCs in the SC7731E, SC9832E, SC9863A line and the T310, T610, T618, T7200, T7225, T7250, T7255, T7280, T7300, T8100, T9100, T8200, and T8300 families are vulnerable. Firmware or SoC revision details are not specified, so all current releases of these families should be treated as at risk until a vendor patch is issued.

The CVSS score of 7.5 indicates high severity, while an EPSS score of less than 1% shows a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting no known active exploits at the time of the advisory. Attack can be carried out remotely by interacting with the IMS service; no privilege escalation is required.