This vulnerability is a reachable assertion that causes ModemManager to abort when parsing certain Cell Broadcast Messages containing 3GPP data‑coding‑scheme values for 8‑bit and reserved character sets. The crash is triggered by a crafted PDU and results in a denial of service by exhausting systemd’s start‑limit for the service, ultimately leaving it in a failed state. The weakness is a buffer control flaw (CWE‑617) that forces execution of defensive abort code. The immediate result is loss of ModemManager functionality and potential downstream service disruption.

The affected product is ModemManager, the daemon that manages cellular modems on Linux‑based systems. No specific version information is supplied in the advisory; any installation that lacks the fix for the Cell Broadcast parsing bug is impacted.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available, suggesting insufficient data on exploitation probability. Because the vulnerability is not listed in CISA KEV, there are no known mass‑scale exploits at the time of writing. The attacker must have the ability to deliver a crafted Cell Broadcast PDU either over the radio network or via a modem AT channel, which implies a level of proximity or control over the device. The attack vector is therefore likely specialized, but once executed it achieves a complete denial of service by crashing ModemManager and potentially cascading failures in systemd services.