{"id":"ASB-A-517376969","details":"In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-517376969","CVE-2026-58882"],"modified":"2026-11-02T16:56:19.932125167Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"severity":"Critical","spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/618039539b4bd57c6761def72a567def95e3dfad","target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java","function":"processMessage"},"deprecated":false,"digest":{"length":1340,"function_hash":"301292263060277054030397461038633389763"},"id":"ASB-A-517376969-2242b85a","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/618039539b4bd57c6761def72a567def95e3dfad","target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"},"deprecated":false,"digest":{"line_hashes":["124841592403275644840789695130339087578","307831861368954435858613919994207219453","249506482586791355484655460340221192148","61624747918641449757092554421007486290","211118586674546394291973253585729862836"],"threshold":0.9},"id":"ASB-A-517376969-6625f9ab","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/618039539b4bd57c6761def72a567def95e3dfad","target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java","function":"decodeWapPdu"},"deprecated":false,"digest":{"function_hash":"206011720669980537422708428219881262592","length":3935},"id":"ASB-A-517376969-c87b2cda"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/618039539b4bd57c6761def72a567def95e3dfad","target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["50315671740620521043018938472500526762","327523050067873121994309737453505693200","241093488370500292990002828214251700968","246833169992112906115089447481380418051"]},"id":"ASB-A-517376969-d1c21ee5","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/618039539b4bd57c6761def72a567def95e3dfad"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376969.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9156a7ed4baaf5dab00cc1fe5d0d791324ce4823","target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["50315671740620521043018938472500526762","327523050067873121994309737453505693200","241093488370500292990002828214251700968","246833169992112906115089447481380418051"]},"id":"ASB-A-517376969-1a14996c"},{"digest":{"line_hashes":["124841592403275644840789695130339087578","307831861368954435858613919994207219453","249506482586791355484655460340221192148","61624747918641449757092554421007486290","211118586674546394291973253585729862836"],"threshold":0.9},"id":"ASB-A-517376969-4941022f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9156a7ed4baaf5dab00cc1fe5d0d791324ce4823","target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"},"deprecated":false},{"target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java","function":"processMessage"},"deprecated":false,"digest":{"length":1340,"function_hash":"301292263060277054030397461038633389763"},"id":"ASB-A-517376969-a4322040","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9156a7ed4baaf5dab00cc1fe5d0d791324ce4823"},{"id":"ASB-A-517376969-b646fc15","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9156a7ed4baaf5dab00cc1fe5d0d791324ce4823","target":{"function":"decodeWapPdu","file":"src/java/com/android/internal/telephony/WapPushOverSms.java"},"deprecated":false,"digest":{"length":3685,"function_hash":"227280303737940474194613510826702972550"}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/9156a7ed4baaf5dab00cc1fe5d0d791324ce4823"],"severity":"Critical","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376969.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5ae6850eecad1ad3ed504fa63a3f68e7db0aef5c","target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java","function":"processMessage"},"deprecated":false,"digest":{"function_hash":"301292263060277054030397461038633389763","length":1340},"id":"ASB-A-517376969-4c78da9c","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5ae6850eecad1ad3ed504fa63a3f68e7db0aef5c","target":{"function":"decodeWapPdu","file":"src/java/com/android/internal/telephony/WapPushOverSms.java"},"deprecated":false,"digest":{"function_hash":"227280303737940474194613510826702972550","length":3685},"id":"ASB-A-517376969-6c44a061","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5ae6850eecad1ad3ed504fa63a3f68e7db0aef5c","target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"},"deprecated":false,"digest":{"line_hashes":["124841592403275644840789695130339087578","307831861368954435858613919994207219453","249506482586791355484655460340221192148","61624747918641449757092554421007486290","211118586674546394291973253585729862836"],"threshold":0.9},"id":"ASB-A-517376969-cc1bd45c","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["50315671740620521043018938472500526762","327523050067873121994309737453505693200","241093488370500292990002828214251700968","246833169992112906115089447481380418051"],"threshold":0.9},"id":"ASB-A-517376969-fa874ce0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5ae6850eecad1ad3ed504fa63a3f68e7db0aef5c","target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/5ae6850eecad1ad3ed504fa63a3f68e7db0aef5c"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376969.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/c1913a4a7948615baf636d7fdced121ef9f5d65c"],"severity":"Critical","spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"id":"ASB-A-517376969-015ee0fc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c1913a4a7948615baf636d7fdced121ef9f5d65c","target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java","function":"decodeWapPdu"},"deprecated":false,"digest":{"length":3685,"function_hash":"227280303737940474194613510826702972550"}},{"digest":{"line_hashes":["124841592403275644840789695130339087578","307831861368954435858613919994207219453","249506482586791355484655460340221192148","61624747918641449757092554421007486290","211118586674546394291973253585729862836"],"threshold":0.9},"id":"ASB-A-517376969-0dbdb791","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c1913a4a7948615baf636d7fdced121ef9f5d65c","target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c1913a4a7948615baf636d7fdced121ef9f5d65c","target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["50315671740620521043018938472500526762","327523050067873121994309737453505693200","241093488370500292990002828214251700968","246833169992112906115089447481380418051"]},"id":"ASB-A-517376969-4c1b0a50","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java","function":"processMessage"},"deprecated":false,"digest":{"function_hash":"301292263060277054030397461038633389763","length":1340},"id":"ASB-A-517376969-87c9eb18","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c1913a4a7948615baf636d7fdced121ef9f5d65c"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376969.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/48a7692ee59ba04e0bfb008218945b563a02ff99","target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"},"deprecated":false,"digest":{"line_hashes":["124841592403275644840789695130339087578","307831861368954435858613919994207219453","249506482586791355484655460340221192148","61624747918641449757092554421007486290","211118586674546394291973253585729862836"],"threshold":0.9},"id":"ASB-A-517376969-19663045","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/48a7692ee59ba04e0bfb008218945b563a02ff99","target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"},"deprecated":false,"digest":{"line_hashes":["50315671740620521043018938472500526762","327523050067873121994309737453505693200","241093488370500292990002828214251700968","246833169992112906115089447481380418051"],"threshold":0.9},"id":"ASB-A-517376969-2706c6d8"},{"deprecated":false,"digest":{"function_hash":"227280303737940474194613510826702972550","length":3685},"id":"ASB-A-517376969-878c96e3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/48a7692ee59ba04e0bfb008218945b563a02ff99","target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java","function":"decodeWapPdu"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/48a7692ee59ba04e0bfb008218945b563a02ff99","target":{"function":"processMessage","file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"},"deprecated":false,"digest":{"function_hash":"301292263060277054030397461038633389763","length":1340},"id":"ASB-A-517376969-eb007f1f","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/48a7692ee59ba04e0bfb008218945b563a02ff99"],"severity":"Critical","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376969.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"302273387230228718561017841354946272990","length":3594},"id":"ASB-A-517376969-4204334c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/1ef3b426c5adf33c4384b363763f4b4cb30a193f","target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java","function":"decodeWapPdu"}},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/1ef3b426c5adf33c4384b363763f4b4cb30a193f","target":{"function":"processMessage","file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"},"deprecated":false,"digest":{"function_hash":"301292263060277054030397461038633389763","length":1340},"id":"ASB-A-517376969-a1a4d2bb","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/1ef3b426c5adf33c4384b363763f4b4cb30a193f","target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["124841592403275644840789695130339087578","307831861368954435858613919994207219453","249506482586791355484655460340221192148","61624747918641449757092554421007486290","211118586674546394291973253585729862836"]},"id":"ASB-A-517376969-d5567218","signature_type":"Line"},{"id":"ASB-A-517376969-efe7edf9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/1ef3b426c5adf33c4384b363763f4b4cb30a193f","target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["50315671740620521043018938472500526762","327523050067873121994309737453505693200","241093488370500292990002828214251700968","246833169992112906115089447481380418051"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/1ef3b426c5adf33c4384b363763f4b4cb30a193f"],"severity":"Critical","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376969.json"}}],"schema_version":"1.9.2"}