Android IMS CVE-2026-55366

Requires the target Android device to have the IP Multimedia Subsystem (IMS) active - i.e., VoLTE/VoWiFi/RCS telephony services enabled and registered - and the attacker able to reach the device's IMS/SIP signaling path to deliver the crafted messages that trigger the authentication-bypass logic error (CWE-693). Per the vendor vector no user interaction and no prior authentication are needed (UI:N/PR:N). Limiting factors: exposure is through the telephony/IMS signaling channel rather than arbitrary Internet services, so practical exploitation most plausibly needs an adjacent or carrier-network position (malicious/compromised IMS core or rogue base station); it is confined to Android devices running unpatched builds prior to the 2026-09-01 Pixel/Android security patch level.

Signals are mixed. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a trivially exploitable, remote, unauthenticated authentication bypass with full CIA impact, which on paper is a top-priority issue. However, EPSS contradicts this urgency: 0.20% probability at only the 10th percentile indicates the modeled likelihood of near-term exploitation is very low. There is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis' - this is NOT confirmed active exploitation. A key tension to verify: the affected component is IP Multimedia Subsystem (IMS), Android's SIP/VoLTE/VoWiFi telephony stack, which in practice is reached over carrier/radio signaling rather than the open Internet - so the AV:N (network) rating may be optimistic and realistic exploitation likely requires an adjacent/carrier-network position (malicious IMS core or rogue base station), which would lower real-world reach. Net: a genuinely serious protection-mechanism failure (CWE-693) worth prompt patching on Android/Pixel fleets, but the low EPSS, absence of KEV/POC, and telephony-path exposure make it a patch-on-cycle priority rather than an emergency, absent evidence of targeted exploitation.

An attacker positioned on the IMS/telephony signaling path (e.g., a malicious or compromised carrier IMS core, or a rogue base station forcing the device onto attacker-controlled infrastructure) sends crafted IMS/SIP messages that trigger the logic error and bypass authentication, gaining escalated privileges on the target Android device without any user interaction. No public exploit code is currently identified, and exploitation realistically depends on the attacker's ability to reach the device's IMS registration/signaling channel.