Android CVE-2026-49932

The attacker must have a malicious application executing on the target device with at least low-level process privileges (PR:L per CVSS). The vulnerability is triggered through the MMS PDU parsing code path in PduParser.java's parseParts function, meaning MMS-related functionality must be reachable from the attacker's process. No user interaction is required after the malicious code begins executing. Exploitation is constrained to local access (AV:L) - network-remote unauthenticated exploitation is not possible based on the available data. Per SSVC, the attack is not automatable, indicating heap exploitation complexity or environment-specific constraints (e.g., ASLR, memory tagging on Android 10+ hardware) that require per-device tuning rather than a fire-and-forget payload. Exploitation is further limited by Android's application sandbox model, which requires obtaining initial code execution on the device first.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a local attack with low complexity and total impact once a low-privileged foothold exists. SSVC assessment of exploitation:none and automatable:no aligns with no known public exploit and the inherent difficulty of heap exploitation on modern Android (ASLR, MTE on newer hardware). However, the SSVC technical impact is rated total, meaning successful exploitation is fully compromising. The breadth of affected versions (five distinct Android branches) significantly amplifies the total exposed population. EPSS data was not provided, limiting quantitative exploitation probability assessment. No KEV listing and no public exploit code identified at time of analysis, which together suggest this has not yet seen mass exploitation - but the attack-vector and impact profile make it a credible privilege escalation target for sophisticated threat actors and malware authors targeting Android. The non-automatable SSVC rating likely reflects heap-exploitation complexity rather than any access barrier.

A malicious Android application installed on the victim device - potentially disguised as a utility app - delivers a crafted MMS PDU structure to trigger the heap buffer overflow in parseParts. No user interaction is required once the app is running; the app exploits the out-of-bounds condition to corrupt adjacent heap metadata and escalate from its sandboxed process context to a higher-privilege system component. No public exploit code exists at time of analysis, but the no-user-interaction requirement and low complexity rating make this a viable target for malware developers.