CVE-2025-61618: 
NixOS vulnerability analysis and mitigation

CVE-2025-61618 is an improper input validation vulnerability in the NR (New Radio/5G) modem component of Unisoc chipsets affecting Android 13, 14, 15, and 16. The flaw can cause a system crash, leading to remote denial of service without requiring any execution privileges or user interaction. It affects devices based on Unisoc T8100, T8200, T8300, and T9100 chipsets. It was published on December 1, 2025, with a CVSS v3.1 base score of 7.5 (High) (Android Bulletin, Unisoc Advisory).

The vulnerability is classified as CWE-20 (Improper Input Validation) and resides in the NR (New Radio/5G) modem component of Unisoc chipsets. An unauthenticated remote attacker can send specially crafted network input to the modem that fails to be properly validated, triggering a system crash. Because the attack vector is network-based and requires no privileges or user interaction, the attack surface is broad for any device with an affected Unisoc chipset connected to a 5G network (Android Bulletin, Unisoc Advisory).

Successful exploitation results in a system-wide crash causing complete loss of availability on the affected device, with no impact to confidentiality or integrity. The vulnerability can render the device entirely unresponsive, potentially disrupting critical communications or services on Android 13–16 devices equipped with Unisoc T8100/T8200/T8300/T9100 chipsets. Because no privileges or user interaction are required, the attack can be launched remotely at scale against vulnerable devices connected to 5G networks (Android Bulletin, Unisoc Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.0015 (0.15%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Android Bulletin, Unisoc Advisory).

Google released patches addressing this vulnerability in the Android Security Bulletin dated December 1, 2025, covering Android versions 13, 14, 15, and 16 on affected Unisoc chipset devices. Users should apply the December 2025 Android security patch level immediately. As a supplementary measure, restricting network access to critical systems and monitoring for unusual network-triggered system crashes or performance degradation is recommended until patching is complete (Android Bulletin, Unisoc Advisory).