A stack-based buffer overflow vulnerability was found in oFono's AT modem USSD handling. The function cusd_parse() in drivers/atmodem/ussd.c uses a bounds check (strlen > sizeof(msg) * 2, i.e., strlen > 320) that is designed for the hex decode paths where 2 input hex characters produce 1 output byte. However, when the GSM 7-bit character set is used (AT_UTIL_CHARSET_GSM + SMS_CHARSET_7BIT), pack_7bit_own_buf() is called which packs each input character into 7/8 bytes of output. This means 320 input characters produce 280 bytes of output, overflowing the 160-byte stack buffer msg[160] by up to 120 bytes.

The correct limit for the GSM 7-bit pack path is 182 characters (182 * 7/8 = 159 bytes). Both the UTF-8 path (ussd_encode) and UCS2 path (ucs2_gsm_to_packed) correctly check for this limit, but the GSM path is missing the check.

A compromised modem baseband can trigger this by sending an unsolicited +CUSD notification with a long payload (e.g., 300 characters) after the modem reports GSM charset via AT+CSCS?. The overflow corrupts the stack frame including saved registers and the return address, leading to a crash or potentially arbitrary code execution. Since ofonod runs as root with no sandbox, successful exploitation grants root-level code execution. No user interaction is required — the +CUSD notification is unsolicited and processed automatically.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.