Modem code execution via 2G ASN.1 overflow

Heap buffer overflow in the Android modem stack allows physically proximate attackers to execute code through crafted 2G call setup data. The ASN.1 parser allocates a one-byte heap buffer, accepts an attacker-controlled length of up to 255 bytes, and writes that amount into the allocation. Exploitation requires a Pixel 6 with 2G enabled and a malicious base station within radio range; the flaw corrupts adjacent heap objects and was chained with a separate executable-memory misconfiguration for total modem compromise.