0xsemizzz/cve-2026-95622ModemManager denial-of-service vulnerability caused by an assertion failure when processing a specially crafted Cell Broadcast Message (CBM).
A denial-of-service vulnerability in ModemManager caused by an assertion failure in the CBM (Cell Broadcast Message) handling code.
A specially crafted CBM message can trigger the assertion failure, causing the ModemManager process to crash.
CVE: CVE-2026-95622
Vulnerability Type: Denial of Service
Affected Component: ModemManager CBM handling
Reporter: Yehia Ali Mohamed Ezzat (0xSemizzz)
CVE-2026-95622 is a denial-of-service vulnerability in ModemManager's handling of Cell Broadcast Messages (CBM).
An attacker can send a specially crafted CBM message that reaches the vulnerable code path and triggers an assertion failure. This causes ModemManager to terminate unexpectedly, resulting in a denial of service.
Successful exploitation can cause the ModemManager service to crash.
Depending on how ModemManager is deployed and supervised by the system, this may result in a temporary loss of modem-related functionality until the service is restarted.
The vulnerability occurs during CBM message processing.
A specially crafted message reaches the affected assertion, causing ModemManager to abort rather than safely handling the malformed input.
For a detailed analysis of the vulnerable code path and exploitation conditions, see the accompanying research write-up:
This vulnerability was responsibly reported to the ModemManager project.
CVE: CVE-2026-95622
Reporter: Yehia Ali Mohamed Ezzat
GitHub: 0xSemizzz
This repository is provided for security research and educational purposes. Use the proof of concept only against systems you own or have explicit authorization to test.
