{"id":"ASB-A-513581684","details":"In parseParts of PduParser.java, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-513581684","CVE-2026-49932"],"modified":"2026-09-17T16:10:43.690857626Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/1c37e9ef69ea9e3768e0c70423fc72383abc2226"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"digest":{"line_hashes":["222999679368863118783159223938291760313","268562113383915931238231549512197167037","335734789903849197841139151370449884242","145770705586163581916908087823991430871","3536906409773883161128582946960240147","281104881560958305181708579352396709003","122807744387868516974550233205029877163","259626072069473153608463580919387526910","242531384169154932084193305298604159265","42569179938916764754103275514633454909","314474558174765813817136548116853762566","186654458427036816563619943159596249056","295734913423145887433887813173388039626","332254899660331249957043536335344757656","55357220466144271105295979052909096128","4896050732649719396099050967673234644","226902848176375405352182084657002297529","278064692573979188331425311133741725623","126079874575065339477804835082674017815","241789812733968406068124775029713836240"],"threshold":0.9},"id":"ASB-A-513581684-186a5da5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f1722a76c071801901ac06aed08252e46f72b217","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"265477641109163600874770427657962889014","length":2310},"id":"ASB-A-513581684-6d4d3cc2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f1722a76c071801901ac06aed08252e46f72b217","target":{"function":"parseParts","file":"telephony/common/com/google/android/mms/pdu/PduParser.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f1722a76c071801901ac06aed08252e46f72b217"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513581684.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"digest":{"line_hashes":["222999679368863118783159223938291760313","268562113383915931238231549512197167037","335734789903849197841139151370449884242","145770705586163581916908087823991430871","3536906409773883161128582946960240147","281104881560958305181708579352396709003","122807744387868516974550233205029877163","259626072069473153608463580919387526910","242531384169154932084193305298604159265","42569179938916764754103275514633454909","314474558174765813817136548116853762566","186654458427036816563619943159596249056","295734913423145887433887813173388039626","332254899660331249957043536335344757656","55357220466144271105295979052909096128","4896050732649719396099050967673234644","226902848176375405352182084657002297529","278064692573979188331425311133741725623","126079874575065339477804835082674017815","241789812733968406068124775029713836240"],"threshold":0.9},"id":"ASB-A-513581684-1ed5ad9f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a7a8d1e7adb481563e615cc9e745eb0ae8220003","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a7a8d1e7adb481563e615cc9e745eb0ae8220003","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java","function":"parseParts"},"deprecated":false,"digest":{"length":1968,"function_hash":"81903043649705649230325623504859643202"},"id":"ASB-A-513581684-68282f25"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a7a8d1e7adb481563e615cc9e745eb0ae8220003"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513581684.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java","function":"parseParts"},"deprecated":false,"digest":{"function_hash":"81903043649705649230325623504859643202","length":1968},"id":"ASB-A-513581684-3f4899f7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8054772bc46861a760c8539bec7a1c87d9ef2b44"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8054772bc46861a760c8539bec7a1c87d9ef2b44","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["222999679368863118783159223938291760313","268562113383915931238231549512197167037","335734789903849197841139151370449884242","145770705586163581916908087823991430871","3536906409773883161128582946960240147","281104881560958305181708579352396709003","122807744387868516974550233205029877163","259626072069473153608463580919387526910","242531384169154932084193305298604159265","42569179938916764754103275514633454909","314474558174765813817136548116853762566","186654458427036816563619943159596249056","295734913423145887433887813173388039626","332254899660331249957043536335344757656","55357220466144271105295979052909096128","4896050732649719396099050967673234644","226902848176375405352182084657002297529","278064692573979188331425311133741725623","126079874575065339477804835082674017815","241789812733968406068124775029713836240"]},"id":"ASB-A-513581684-ebe3467e"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8054772bc46861a760c8539bec7a1c87d9ef2b44"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513581684.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"digest":{"length":1968,"function_hash":"81903043649705649230325623504859643202"},"id":"ASB-A-513581684-0154fd5c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23b07025ef0490fed58808443f2ed7cc86e103ea","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java","function":"parseParts"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["222999679368863118783159223938291760313","268562113383915931238231549512197167037","335734789903849197841139151370449884242","145770705586163581916908087823991430871","3536906409773883161128582946960240147","281104881560958305181708579352396709003","122807744387868516974550233205029877163","259626072069473153608463580919387526910","242531384169154932084193305298604159265","42569179938916764754103275514633454909","314474558174765813817136548116853762566","186654458427036816563619943159596249056","295734913423145887433887813173388039626","332254899660331249957043536335344757656","55357220466144271105295979052909096128","4896050732649719396099050967673234644","226902848176375405352182084657002297529","278064692573979188331425311133741725623","126079874575065339477804835082674017815","241789812733968406068124775029713836240"]},"id":"ASB-A-513581684-2241deb4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23b07025ef0490fed58808443f2ed7cc86e103ea","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/23b07025ef0490fed58808443f2ed7cc86e103ea"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513581684.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3d7660e07fa510be63a637600c5e790de5181bf3","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["222999679368863118783159223938291760313","268562113383915931238231549512197167037","335734789903849197841139151370449884242","145770705586163581916908087823991430871","3536906409773883161128582946960240147","281104881560958305181708579352396709003","122807744387868516974550233205029877163","259626072069473153608463580919387526910","242531384169154932084193305298604159265","42569179938916764754103275514633454909","314474558174765813817136548116853762566","186654458427036816563619943159596249056","295734913423145887433887813173388039626","332254899660331249957043536335344757656","55357220466144271105295979052909096128","4896050732649719396099050967673234644","226902848176375405352182084657002297529","278064692573979188331425311133741725623","126079874575065339477804835082674017815","241789812733968406068124775029713836240"]},"id":"ASB-A-513581684-84c80c63","signature_type":"Line"},{"id":"ASB-A-513581684-f46602b2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3d7660e07fa510be63a637600c5e790de5181bf3","target":{"function":"parseParts","file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"function_hash":"81903043649705649230325623504859643202","length":1968}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3d7660e07fa510be63a637600c5e790de5181bf3"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513581684.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"81903043649705649230325623504859643202","length":1968},"id":"ASB-A-513581684-67752397","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fdc59ab8f2de90c3435f55628049179f70ec59ce","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java","function":"parseParts"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fdc59ab8f2de90c3435f55628049179f70ec59ce","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["222999679368863118783159223938291760313","268562113383915931238231549512197167037","335734789903849197841139151370449884242","145770705586163581916908087823991430871","3536906409773883161128582946960240147","281104881560958305181708579352396709003","122807744387868516974550233205029877163","259626072069473153608463580919387526910","242531384169154932084193305298604159265","42569179938916764754103275514633454909","314474558174765813817136548116853762566","186654458427036816563619943159596249056","295734913423145887433887813173388039626","332254899660331249957043536335344757656","55357220466144271105295979052909096128","4896050732649719396099050967673234644","226902848176375405352182084657002297529","278064692573979188331425311133741725623","126079874575065339477804835082674017815","241789812733968406068124775029713836240"]},"id":"ASB-A-513581684-fd7e06ad","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fdc59ab8f2de90c3435f55628049179f70ec59ce"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513581684.json"}}],"schema_version":"1.9.0"}