EUVD-2026-92605
GHSA-4vm2-jjcf-2h53
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed PDU payload
-
ExploitDeliver to target Android device
-
ExecutionParser performs out-of-bounds read
-
ImpactHandling process crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the vulnerable code path in PduParser.java to process an attacker-supplied PDU (Protocol Data Unit, as used in Android MMS/messaging parsing); the attacker must be able to deliver a crafted/malformed PDU to the device. No user interaction is required (UI:N) and no additional execution privileges are stated as needed per the description. The CVSS vector lists PR:L, implying some privilege may be required, which conflicts with the 'no additional execution privileges needed' description - this limiting factor is unverified. Impact is confined to denial of service (availability); there is no confidentiality or integrity impact, and no code execution. Exploitation is rated non-automatable by SSVC. Affected to Android 14, 15, 16, 16-qpr2, and 17. |
| Impact | This is a moderate, low-priority issue despite its CVSS 6.5 (MEDIUM) rating, and multiple independent signals agree on that. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scopes impact to availability only (C:N/I:N) - an out-of-bounds read (CWE-119) causing a remote denial of service, not code execution. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or public exploitation), Automatable=no, and Technical Impact=partial. EPSS and KEV are not present in the input; absence of a KEV listing is consistent with SSVC Exploitation=none, indicating no evidence of active exploitation. There is a notable internal conflict in the authentication signal that defenders should verify: the CVSS vector specifies PR:L (some privileges required), yet the Android description states the flaw 'could lead to a remote denial of service with no additional execution privileges needed' and 'User interaction is not needed' - the 'no additional privileges' wording reads closer to PR:N. This discrepancy should be verified against the Android bulletin before relying on PR:L as a mitigating factor. Also note A:H in the vector versus SSVC Technical Impact=partial, suggesting the real-world availability impact (a parser crash) is likely a bounded component DoS rather than total device unavailability. |
| Exploit ScenarioDerived | An attacker delivers a malformed PDU (e.g., a crafted MMS/messaging payload) to a target Android device; when PduParser.java parses it, the missing bounds check triggers an out-of-bounds read that crashes the handling process, denying service. No user interaction is required. No public exploit code has been identified, and exploitation is rated non-automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Out-of-bounds read in Google Android's MMS PDU parsing code (PduParser.java) allows a remote attacker who can deliver a crafted or malformed Protocol Data Unit to the device to trigger a denial of service against the affected messaging/telephony component, with no user interaction required. Affected platforms are Android 14, 15, 16, 16-qpr2 and 17, per the EUVD version list and the wildcard CPE cpe:2.3:a:google:android:*; the vulnerability is rated CVSS 6.5 (MEDIUM), though independent review downgrades the availability impact to Low and confirms confidentiality and integrity are unaffected, with no code execution possible. No public exploit code has been identified and SSVC rates the issue as non-automatable with exploitation status 'none', so this is assessed as a moderate, low-priority denial-of-service hardening issue rather than an urgent threat.
RemediationAI
Patch status: patch available per vendor advisory - apply the Android Security Bulletin for October 2026 (2026-10-01 patch level or later), documented at https://source.android.com/docs/security/bulletin/2026/2026-10-01; the provided data does not include an individual commit hash or a component-specific patch level, so administrators should confirm the device reports the 2026-10-01 (or later) security patch level rather than assuming any single build is fixed. Because this is a local-platform fix distributed through OEM/carrier update channels, Android Enterprise administrators should prioritize this within normal monthly maintenance rather than as an emergency, given the assessed Low availability impact and no known exploitation. Compensating controls, if patching must be deferred: disable automatic MMS retrieval/auto-download in the default messaging app (trade-off: MMS messages are no longer previewed automatically, and the user must manually download them, shifting the decision to the user but also reducing the attack surface); where MMS is not business-critical, block MMS at the carrier/APN or MDM level or disable the messaging app entirely for managed profiles (trade-off: loss of picture/video messaging); and restrict routing of inbound MMS from untrusted senders via carrier controls where available (trade-off: potential loss of legitimate messages, and no protection against attacks delivered through other PDU-bearing interfaces). None of these workarounds fully substitute for the vendor patch, since any code path that still parses attacker-supplied PDUs remains reachable.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PduParser.java is part of Android's messaging stack, responsible for decoding binary Protocol Data Units (PDUs) used by SMS/MMS encapsulation (WSP/MMS-style length-prefixed structures). The flaw is classified CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and arises because one or more parsing routines in PduParser.java consume length or offset fields from the untrusted PDU without validating that the referenced data stays within the backing buffer, producing an out-of-bounds read. The practical consequence is a crash or mis-parse of the messaging component (availability loss only), not memory corruption leading to code execution, which is consistent with the C:N/I:N/A:H vector in the published CVSS and with our independent assessment narrowing availability impact to Low. Note a data conflict relevant to exploitation prerequisites: the published vector uses PR:L (privilege required), while the vendor description states no additional execution privileges are needed; our re-assessment uses PR:N/UI:N, but this privilege requirement remains unverified and should not be treated as settled. SSVC additionally rates the issue non-automatable, meaning mass opportunistic exploitation of the vulnerable code path is not expected.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Untrusted remote PDU parsing needs no privileges (PR:N, diverging from vendor PR:L, which conflicts with the description) or interaction; an OOB-read crash is a bounded component DoS, so A:L matching SSVC partial impact.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB