CVE-2025-71255
Published: 06 May 2026
Summary
CVE-2025-71255 is a high-severity an unspecified weakness vulnerability in Google Android. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 21.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-71255 is an improper input validation vulnerability in the Modem IMS component. Published on 2026-05-06, it has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), rated as High severity, with impacts limited to high availability disruption and no confidentiality or integrity effects.
A remote attacker requires no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation leads to denial of service, potentially disrupting modem functionality without code execution or privilege escalation.
Unisoc has published a product security bulletin detailing the issue at https://www.unisoc.com/en/support/product-security-bulletin/2051836844671422466, which security practitioners should consult for mitigation guidance and available patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209655
Vulnerability details
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper input validation in Modem IMS directly enables remote unauthenticated DoS via application/system exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly enforces proper validation of information inputs in the Modem IMS component, preventing exploitation of the improper input validation vulnerability leading to remote DoS.
SC-5 protects against and limits the effects of denial-of-service events like those caused by malformed inputs to the Modem IMS, directly mitigating the high availability impact.
SI-2 ensures timely identification, reporting, and remediation of flaws such as CVE-2025-71255 in the Modem IMS component via patching.