EUVD-2026-92618
GHSA-rpc2-cc4h-6mpj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain target phone number
-
DeliverySend crafted MMS PDU
-
ExploitTrigger missing bounds check in parser
-
ExecutionCrash messaging/telephony process
-
ImpactPersistent denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires delivering a crafted MMS/WAP PDU message to the target device so that Android's PduParser.java parses the malformed input; per CVSS (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed because MMS PDUs are parsed automatically on receipt. Limiting factors: the attacker must be able to route an MMS to the victim (typically knowledge of the phone number and carrier MMS reachability), and the device must run an affected release (Android 14, 15, 16, 16-qpr2, or 17); impact is limited to denial of service (process crash / persistent disruption) with no confidentiality or integrity effect and no privilege gain. |
| Impact | Signals are largely consistent and point to a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which on its own looks alarming; however, impact is strictly availability (C:N/I:N/A:H) - this is a denial-of-service bug (missing bounds check in Android's MMS PduParser.java), not code execution, so the 7.5 score reflects crash/availability loss only. CISA's SSVC framework corroborates a measured posture: Exploitation=none (no observed activity), Automatable=yes (reachable and scriptable via MMS delivery), and Technical Impact=partial. There is no CISA KEV listing and no POC or EPSS score supplied in the input, so there is no evidence of active exploitation - only latent exploitability. Net: this is a real, patch-worthy issue because of the huge Android install base and zero-click MMS reachability, but absent exploitation evidence it is a high-priority-to-patch availability bug rather than an emergency RCE. Note the CWE (CWE-119 buffer/bounds) combined with the explicit 'denial of service' description and A-only impact is coherent, but the use of CWE-119 could invite confusion with memory-corruption RCE - the vendor description and CVSS impact confirm availability-only, so that distinction should be verified against the final Android bulletin entry. |
| Exploit ScenarioDerived | An attacker who knows a target's phone number sends a specially crafted MMS/WAP PDU whose malformed length or field triggers the missing bounds check in PduParser.java as the device automatically parses the incoming message. No public exploit is identified at time of analysis, but because parsing occurs with no user interaction, the messaging/telephony process crashes, and because the condition is persistent the device can be repeatedly or continuously disrupted on redelivery. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Remote denial of service in Google Android 14, 15, 16, 16 QPR2, and 17 allows an unauthenticated attacker to crash the device's message-parsing path and cause persistent disruption by sending a crafted MMS/WAP PDU that PduParser.java decodes without an adequate bounds check. Because MMS PDUs are parsed automatically upon receipt, no user interaction or credentials are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5); the only practical precondition is that the attacker can route an MMS to the victim's handset, which normally implies knowing the phone number and having carrier MMS reachability. CISA's SSVC evaluation records exploitation as none with no public exploit identified at time of analysis, although the flaw is classified as automatable, and impact is confined to availability (crash / persistent denial of service) with no confidentiality, integrity, or privilege gain.
RemediationAI
Apply the vendor fix by updating affected devices to the Android Security Bulletin level published at https://source.android.com/docs/security/bulletin/2026/2026-10-01 (October 2026 bulletin, 2026-10-01 patch level); the bulletin is the authoritative source for the exact patched builds per device and OEM, and until a device reports that security patch level (Settings > About phone > Android version > Android security update) it should be treated as unfixed, since patch availability per the vendor advisory is not the same as a released, installed build. In the interim, the most effective compensating control is to disable automatic MMS retrieval so that malformed PDUs are not decoded without a deliberate user action: in Google Messages this means turning off auto-download of MMS (Settings > Advanced / Auto-download MMS), and equivalent settings exist in other clients or must be applied per carrier - the trade-off is that picture, group, and long messages arrive only after manual download and may expire at the carrier. Enterprise administrators can enforce the same posture via MDM policy that blocks or quarantines MMS auto-retrieval, at the cost of degrading rich-messaging features for managed users. Carrier-side or network-level filtering of MMS traffic can reduce exposure but is outside most defenders' control and risks dropping legitimate messages, and blocking MMS entirely on the device is a last resort that breaks group and multimedia messaging. Because exploitation is rated automatable with no public exploit identified, these steps are precautionary rather than urgent incident response; monitoring for repeated messaging/telephony process crashes on affected devices is a useful detection signal for attempted abuse.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PduParser.java is part of Android's MMS/WAP Push decoding stack: it walks the binary Protocol Data Unit (PDU) carried in an MMS notification or retrieval response, reading length-prefixed fields and headers supplied entirely by a remote sender. The root cause class is CWE-119 (improper restriction of operations within the bounds of a memory buffer), consistent with the 'Buffer Overflow' tag on this record: a missing bounds check on attacker-controlled PDU fields allows out-of-bounds access during parsing. Because this parsing runs in the messaging/telephony surface that processes incoming messages without user confirmation, a single malformed PDU is enough to fault the parsing process; the outcome described in the advisory is a persistent denial of service, i.e. repeated or unrecoverable disruption rather than a one-off transient error. Note that despite the memory-safety flavor of CWE-119, the scored and independently assessed impact is availability-only (C:N/I:N/A:H) with scope unchanged (S:U) and no privilege escalation, and the SSVC technical impact is rated 'partial'. The CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* confirms this is an AOSP platform component affecting Android builds broadly rather than a third-party application.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
MMS PDU is parsed automatically over the network with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only crash (A:H, C:N/I:N) within the same component (S:U).
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 2
Executive ViewAI
A high-severity, unauthenticated remote denial-of-service flaw in Google Android 14, 15, 16, 16 QPR2, and 17 allows anyone who can route a crafted MMS to a handset to crash the device's message-parsing path with no user interaction, potentially causing persistent disruption. Because MMS messages are parsed automatically on receipt, every Android phone in the fleet - including executive and field devices - is exposed without any user mistake, making the primary organizational risk fleet-wide availability loss and help-desk escalation rather than data theft. No public exploit code or active exploitation has been identified, but the flaw is rated automatable, so leadership should treat remediation and interim MMS controls as a prioritized mobile-security workstream.
No vendor-released patch identified at time of analysis. Interim mitigations: disable automatic MMS download/auto-retrieval in all messaging clients (enforced via MDM), restrict or block MMS delivery at the carrier or mobile gateway for high-risk users, enable device crash-loop monitoring and alerting to detect repeated PDU-triggered outages, and maintain a rapid battery-pull/device-reset and device-swap procedure for affected handsets.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB