{"id":"ASB-A-513582756","details":"In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-513582756","CVE-2026-58865"],"modified":"2026-10-05T16:41:14.420176744Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cbb0d81bf0866a8249eca7c7ec53f7c179f8b171"],"severity":"Critical","spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/cbb0d81bf0866a8249eca7c7ec53f7c179f8b171","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java","function":"parseContentType"},"deprecated":false,"digest":{"function_hash":"314940485894880811648491129293487900571","length":1592},"id":"ASB-A-513582756-1afa564b","signature_type":"Function","signature_version":"v1"},{"digest":{"length":2477,"function_hash":"277221246370813724179016272419702950668"},"id":"ASB-A-513582756-3c5845c7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cbb0d81bf0866a8249eca7c7ec53f7c179f8b171","target":{"function":"parseContentTypeParams","file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cbb0d81bf0866a8249eca7c7ec53f7c179f8b171","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["221055522953956051678101754868005301867","246372188126246572812188774197351161390","281623435956091713220251728185709768110","48941274909898256336905146053733671925","200105241365177374814096973435794357825","188359644950485383119335305679828308192","333444555279270979922390420640613509907","112033778006066042788205432177730319351","128103567233057664704687448450809305916","86347077202209404478728092550917754491","127723216770059202317310007221979593450","328154776566745470925053093035363262332","239326934292218533866360919639771866231","89236501579864920009527905766295369462","317725191553442060255613378488830928055","314043105192423930670971262105779970606","95184429457273828862464966939912107312","313171328178836839674964596376267951093","22043560488274024081961986077965828036"]},"id":"ASB-A-513582756-cdd0ad9f","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513582756.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"Critical","spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ffbf593b30317c10dc95a9ab2a0ead09e33b9549","target":{"function":"parseContentTypeParams","file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"length":2477,"function_hash":"277221246370813724179016272419702950668"},"id":"ASB-A-513582756-6e63c6ae"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ffbf593b30317c10dc95a9ab2a0ead09e33b9549","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["221055522953956051678101754868005301867","246372188126246572812188774197351161390","281623435956091713220251728185709768110","48941274909898256336905146053733671925","200105241365177374814096973435794357825","188359644950485383119335305679828308192","333444555279270979922390420640613509907","112033778006066042788205432177730319351","128103567233057664704687448450809305916","86347077202209404478728092550917754491","127723216770059202317310007221979593450","328154776566745470925053093035363262332","239326934292218533866360919639771866231","89236501579864920009527905766295369462","317725191553442060255613378488830928055","314043105192423930670971262105779970606","95184429457273828862464966939912107312","313171328178836839674964596376267951093","22043560488274024081961986077965828036"]},"id":"ASB-A-513582756-ce614977","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ffbf593b30317c10dc95a9ab2a0ead09e33b9549","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java","function":"parseContentType"},"deprecated":false,"digest":{"function_hash":"128172258089473237359508295994700672622","length":1581},"id":"ASB-A-513582756-f0004d15","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ffbf593b30317c10dc95a9ab2a0ead09e33b9549"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513582756.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"id":"ASB-A-513582756-233e717f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1a78b08e5a51bd5fb285234a3b06df549560dbb2","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java","function":"parseContentTypeParams"},"deprecated":false,"digest":{"function_hash":"277221246370813724179016272419702950668","length":2477}},{"id":"ASB-A-513582756-23f187eb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1a78b08e5a51bd5fb285234a3b06df549560dbb2","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"line_hashes":["221055522953956051678101754868005301867","246372188126246572812188774197351161390","281623435956091713220251728185709768110","48941274909898256336905146053733671925","200105241365177374814096973435794357825","188359644950485383119335305679828308192","333444555279270979922390420640613509907","112033778006066042788205432177730319351","128103567233057664704687448450809305916","86347077202209404478728092550917754491","127723216770059202317310007221979593450","328154776566745470925053093035363262332","239326934292218533866360919639771866231","89236501579864920009527905766295369462","317725191553442060255613378488830928055","314043105192423930670971262105779970606","95184429457273828862464966939912107312","313171328178836839674964596376267951093","22043560488274024081961986077965828036"],"threshold":0.9}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1a78b08e5a51bd5fb285234a3b06df549560dbb2","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java","function":"parseContentType"},"deprecated":false,"digest":{"length":1581,"function_hash":"128172258089473237359508295994700672622"},"id":"ASB-A-513582756-7cd2af99","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1a78b08e5a51bd5fb285234a3b06df549560dbb2"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513582756.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"128172258089473237359508295994700672622","length":1581},"id":"ASB-A-513582756-4bb86262","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/818661bd29438f09ea0ae969de3a596ddab3c9a5","target":{"function":"parseContentType","file":"telephony/common/com/google/android/mms/pdu/PduParser.java"}},{"digest":{"line_hashes":["221055522953956051678101754868005301867","246372188126246572812188774197351161390","281623435956091713220251728185709768110","48941274909898256336905146053733671925","200105241365177374814096973435794357825","188359644950485383119335305679828308192","333444555279270979922390420640613509907","112033778006066042788205432177730319351","128103567233057664704687448450809305916","86347077202209404478728092550917754491","127723216770059202317310007221979593450","328154776566745470925053093035363262332","239326934292218533866360919639771866231","89236501579864920009527905766295369462","317725191553442060255613378488830928055","314043105192423930670971262105779970606","95184429457273828862464966939912107312","313171328178836839674964596376267951093","22043560488274024081961986077965828036"],"threshold":0.9},"id":"ASB-A-513582756-7145fd69","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/818661bd29438f09ea0ae969de3a596ddab3c9a5","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false},{"id":"ASB-A-513582756-e16c6b1c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/818661bd29438f09ea0ae969de3a596ddab3c9a5","target":{"function":"parseContentTypeParams","file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"function_hash":"277221246370813724179016272419702950668","length":2477}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/818661bd29438f09ea0ae969de3a596ddab3c9a5"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513582756.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"id":"ASB-A-513582756-773ce726","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/937e32d05a639e88fb42b824af2b7d678bcf2b30","target":{"function":"parseContentType","file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"length":1581,"function_hash":"128172258089473237359508295994700672622"}},{"id":"ASB-A-513582756-acc73f77","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/937e32d05a639e88fb42b824af2b7d678bcf2b30","target":{"function":"parseContentTypeParams","file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"function_hash":"277221246370813724179016272419702950668","length":2477}},{"digest":{"line_hashes":["221055522953956051678101754868005301867","246372188126246572812188774197351161390","281623435956091713220251728185709768110","48941274909898256336905146053733671925","200105241365177374814096973435794357825","188359644950485383119335305679828308192","333444555279270979922390420640613509907","112033778006066042788205432177730319351","128103567233057664704687448450809305916","86347077202209404478728092550917754491","127723216770059202317310007221979593450","328154776566745470925053093035363262332","239326934292218533866360919639771866231","89236501579864920009527905766295369462","317725191553442060255613378488830928055","314043105192423930670971262105779970606","95184429457273828862464966939912107312","313171328178836839674964596376267951093","22043560488274024081961986077965828036"],"threshold":0.9},"id":"ASB-A-513582756-bd8b33c1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/937e32d05a639e88fb42b824af2b7d678bcf2b30","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/937e32d05a639e88fb42b824af2b7d678bcf2b30"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513582756.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"Critical","spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"digest":{"length":1592,"function_hash":"314940485894880811648491129293487900571"},"id":"ASB-A-513582756-0fc5cb5e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fee2e475e00a5c603867030e242c188bf754ba65","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java","function":"parseContentType"},"deprecated":false},{"deprecated":false,"digest":{"length":2477,"function_hash":"277221246370813724179016272419702950668"},"id":"ASB-A-513582756-21045089","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fee2e475e00a5c603867030e242c188bf754ba65","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java","function":"parseContentTypeParams"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fee2e475e00a5c603867030e242c188bf754ba65","target":{"file":"telephony/common/com/google/android/mms/pdu/PduParser.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["221055522953956051678101754868005301867","246372188126246572812188774197351161390","281623435956091713220251728185709768110","48941274909898256336905146053733671925","200105241365177374814096973435794357825","188359644950485383119335305679828308192","333444555279270979922390420640613509907","112033778006066042788205432177730319351","128103567233057664704687448450809305916","86347077202209404478728092550917754491","127723216770059202317310007221979593450","328154776566745470925053093035363262332","239326934292218533866360919639771866231","89236501579864920009527905766295369462","317725191553442060255613378488830928055","314043105192423930670971262105779970606","95184429457273828862464966939912107312","313171328178836839674964596376267951093","22043560488274024081961986077965828036"]},"id":"ASB-A-513582756-693d75bf","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fee2e475e00a5c603867030e242c188bf754ba65"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513582756.json"}}],"schema_version":"1.9.0"}