CVE-2025-71252
Published: 06 May 2026
Summary
CVE-2025-71252 is a high-severity an unspecified weakness vulnerability in Google Android. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 21.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-71252 is an improper input validation vulnerability in the Modem IMS component. This issue affects software or devices incorporating Modem IMS, as detailed in the Unisoc product security bulletin. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting high severity due to its potential for significant availability impact.
The vulnerability enables a remote attacker to exploit it over the network with low attack complexity, requiring no authentication privileges or user interaction. Successful exploitation results in a denial of service condition on the affected Modem IMS, disrupting service availability without compromising confidentiality or integrity.
Mitigation guidance is available in the Unisoc product security bulletin at https://www.unisoc.com/en/support/product-security-bulletin/2051836844671422466.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209649
Vulnerability details
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper input validation enables remote service exhaustion/crash (DoS) on Modem IMS component, directly mapping to T1499 Endpoint Denial of Service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validating all information inputs to the system, preventing exploitation of the improper input validation flaw in Modem IMS that leads to remote DoS.
Mandates timely identification, reporting, and remediation of flaws like CVE-2025-71252, applying patches from the Unisoc bulletin to eliminate the vulnerability.
Provides denial-of-service protection mechanisms that limit the impact of remote attacks exploiting the Modem IMS input validation flaw.