CVE catalog

CVE-2026-95622

modemmanager: CVE-2026-95622

Severity: Medium · CVSS 6.5CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Sep 24, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]

A flaw was found in ModemManager. When parsing a Cell Broadcast Message, some 3GPP data-coding-scheme values (8-bit and reserved character sets) are not handled. The process hits a reachable assertion and aborts. An attacker who can deliver a crafted Cell Broadcast PDU over the radio network, or via a modem AT channel, can cause ModemManager to exit. Repeated aborts can exhaust systemd's default start limit and leave the service failed. ModemManager: ModemManager: Reachable assertion in Cell Broadcast encoding parse causes denial of service This vulnerability impacts ModemManager version 1.24 and above following the introduction of Cell Broadcast parsing. Red Hat Enterprise Linux (RHEL) remains unaffected, as it does not ship these newer versions and lacks the vulnerable code path. Although the reporter assigned a "Low" severity rating due to the attack requiring a malicious base station or compromised radio network (reflected in the AV:A vector), a single malicious PDU under those conditions will crash the root ModemManager process. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	modemmanager	sid	`1.24.2-2`	vulnerable
Debian	modemmanager	forky	`1.24.2-2`	vulnerable
Debian	modemmanager	trixie	`1.24.0-1+deb13u1`	vulnerable
Debian	modemmanager	bookworm	`1.20.4-1`	not affected

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	modemmanager	source	sid	`(unfixed)`	not yet assigned	Not reported	[1149673]
Debian	modemmanager	source	forky	`(unfixed)`	not yet assigned	Not reported	[1149673]
Debian	modemmanager	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1149673]
Debian	modemmanager	source	bookworm	`Not affected`	unimportant	Not reported	[1149673]

[Debian bug #1149673]

Notes

[trixie] modemmanager: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

[gir1.2-modemmanager-1.0]Affected
Source package: [modemmanager]
Details (2)
- 1.24.0-1+deb13u1 · amd64 · trixie
  Affected
  dsa · modemmanager · debian · 13
- 1.24.0-1+deb13u1 · arm64 · trixie
  Affected
  dsa · modemmanager · debian · 13
[libmm-glib0]Affected
Source package: [modemmanager]
Details (2)
- 1.24.0-1+deb13u1 · amd64 · trixie
  Affected
  dsa · modemmanager · debian · 13
- 1.24.0-1+deb13u1 · arm64 · trixie
  Affected
  dsa · modemmanager · debian · 13
[libmm-glib-dev]Affected
Source package: [modemmanager]
Details (2)
- 1.24.0-1+deb13u1 · amd64 · trixie
  Affected
  dsa · modemmanager · debian · 13
- 1.24.0-1+deb13u1 · arm64 · trixie
  Affected
  dsa · modemmanager · debian · 13
[libmm-glib-doc]Affected
Source package: [modemmanager]
Details (2)
- 1.24.0-1+deb13u1 · all · trixie
  Affected
  dsa · modemmanager · debian · 13
- 1.24.0-1+deb13u1 · all · trixie
  Affected
  dsa · modemmanager · debian · 13
[modemmanager]Affected
Details (2)
- 1.24.0-1+deb13u1 · amd64 · trixie
  Affected
  dsa · modemmanager · debian · 13
- 1.24.0-1+deb13u1 · arm64 · trixie
  Affected
  dsa · modemmanager · debian · 13
[modemmanager-dev]Affected
Source package: [modemmanager]
Details (2)
- 1.24.0-1+deb13u1 · amd64 · trixie
  Affected
  dsa · modemmanager · debian · 13
- 1.24.0-1+deb13u1 · arm64 · trixie
  Affected
  dsa · modemmanager · debian · 13
[modemmanager-doc]Affected
Source package: [modemmanager]
Details (2)
- 1.24.0-1+deb13u1 · all · trixie
  Affected
  dsa · modemmanager · debian · 13
- 1.24.0-1+deb13u1 · all · trixie
  Affected
  dsa · modemmanager · debian · 13

[Debian 12 (Bookworm)]

[gir1.2-modemmanager-1.0]Not affected
Source package: [modemmanager]
Details (2)
- 1.20.4-1 · amd64 · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
- 1.20.4-1 · arm64 · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
[libmm-glib0]Not affected
Source package: [modemmanager]
Details (2)
- 1.20.4-1 · amd64 · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
- 1.20.4-1 · arm64 · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
[libmm-glib-dev]Not affected
Source package: [modemmanager]
Details (2)
- 1.20.4-1 · amd64 · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
- 1.20.4-1 · arm64 · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
[libmm-glib-doc]Not affected
Source package: [modemmanager]
Details (2)
- 1.20.4-1 · all · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
- 1.20.4-1 · all · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
[modemmanager]Not affected
Details (2)
- 1.20.4-1 · amd64 · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
- 1.20.4-1 · arm64 · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
[modemmanager-dev]Not affected
Source package: [modemmanager]
Details (2)
- 1.20.4-1 · amd64 · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
- 1.20.4-1 · arm64 · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
[modemmanager-doc]Not affected
Source package: [modemmanager]
Details (2)
- 1.20.4-1 · all · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm
- 1.20.4-1 · all · bookworm
  Not affected
  dsa · modemmanager · debian · bookworm

Observed: Oct 23, 2026, 7:48:10 PM UTC

References

[Debian Security Tracker] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]