{"id":"ASB-A-517376969", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58882", "A-517376969"], "details":"In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/618039539b4bd57c6761def72a567def95e3dfad"], "severity":"Critical", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"301292263060277054030397461038633389763", "length":1340}, "id":"ASB-A-517376969-2242b85a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/618039539b4bd57c6761def72a567def95e3dfad", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java", "function":"processMessage"}}, {"deprecated":false, "digest":{"line_hashes":["124841592403275644840789695130339087578", "307831861368954435858613919994207219453", "249506482586791355484655460340221192148", "61624747918641449757092554421007486290", "211118586674546394291973253585729862836"], "threshold":0.9}, "id":"ASB-A-517376969-6625f9ab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/618039539b4bd57c6761def72a567def95e3dfad", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"}}, {"deprecated":false, "digest":{"function_hash":"206011720669980537422708428219881262592", "length":3935}, "id":"ASB-A-517376969-c87b2cda", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/618039539b4bd57c6761def72a567def95e3dfad", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java", "function":"decodeWapPdu"}}, {"deprecated":false, "digest":{"line_hashes":["50315671740620521043018938472500526762", "327523050067873121994309737453505693200", "241093488370500292990002828214251700968", "246833169992112906115089447481380418051"], "threshold":0.9}, "id":"ASB-A-517376969-d1c21ee5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/618039539b4bd57c6761def72a567def95e3dfad", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/9156a7ed4baaf5dab00cc1fe5d0d791324ce4823"], "severity":"Critical", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["50315671740620521043018938472500526762", "327523050067873121994309737453505693200", "241093488370500292990002828214251700968", "246833169992112906115089447481380418051"], "threshold":0.9}, "id":"ASB-A-517376969-1a14996c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9156a7ed4baaf5dab00cc1fe5d0d791324ce4823", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"}}, {"deprecated":false, "digest":{"line_hashes":["124841592403275644840789695130339087578", "307831861368954435858613919994207219453", "249506482586791355484655460340221192148", "61624747918641449757092554421007486290", "211118586674546394291973253585729862836"], "threshold":0.9}, "id":"ASB-A-517376969-4941022f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9156a7ed4baaf5dab00cc1fe5d0d791324ce4823", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"}}, {"deprecated":false, "digest":{"function_hash":"301292263060277054030397461038633389763", "length":1340}, "id":"ASB-A-517376969-a4322040", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9156a7ed4baaf5dab00cc1fe5d0d791324ce4823", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java", "function":"processMessage"}}, {"deprecated":false, "digest":{"function_hash":"227280303737940474194613510826702972550", "length":3685}, "id":"ASB-A-517376969-b646fc15", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9156a7ed4baaf5dab00cc1fe5d0d791324ce4823", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java", "function":"decodeWapPdu"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/5ae6850eecad1ad3ed504fa63a3f68e7db0aef5c"], "severity":"Critical", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"301292263060277054030397461038633389763", "length":1340}, "id":"ASB-A-517376969-4c78da9c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5ae6850eecad1ad3ed504fa63a3f68e7db0aef5c", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java", "function":"processMessage"}}, {"deprecated":false, "digest":{"function_hash":"227280303737940474194613510826702972550", "length":3685}, "id":"ASB-A-517376969-6c44a061", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5ae6850eecad1ad3ed504fa63a3f68e7db0aef5c", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java", "function":"decodeWapPdu"}}, {"deprecated":false, "digest":{"line_hashes":["124841592403275644840789695130339087578", "307831861368954435858613919994207219453", "249506482586791355484655460340221192148", "61624747918641449757092554421007486290", "211118586674546394291973253585729862836"], "threshold":0.9}, "id":"ASB-A-517376969-cc1bd45c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5ae6850eecad1ad3ed504fa63a3f68e7db0aef5c", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"}}, {"deprecated":false, "digest":{"line_hashes":["50315671740620521043018938472500526762", "327523050067873121994309737453505693200", "241093488370500292990002828214251700968", "246833169992112906115089447481380418051"], "threshold":0.9}, "id":"ASB-A-517376969-fa874ce0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5ae6850eecad1ad3ed504fa63a3f68e7db0aef5c", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/c1913a4a7948615baf636d7fdced121ef9f5d65c"], "severity":"Critical", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"227280303737940474194613510826702972550", "length":3685}, "id":"ASB-A-517376969-015ee0fc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c1913a4a7948615baf636d7fdced121ef9f5d65c", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java", "function":"decodeWapPdu"}}, {"deprecated":false, "digest":{"line_hashes":["124841592403275644840789695130339087578", "307831861368954435858613919994207219453", "249506482586791355484655460340221192148", "61624747918641449757092554421007486290", "211118586674546394291973253585729862836"], "threshold":0.9}, "id":"ASB-A-517376969-0dbdb791", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c1913a4a7948615baf636d7fdced121ef9f5d65c", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"}}, {"deprecated":false, "digest":{"line_hashes":["50315671740620521043018938472500526762", "327523050067873121994309737453505693200", "241093488370500292990002828214251700968", "246833169992112906115089447481380418051"], "threshold":0.9}, "id":"ASB-A-517376969-4c1b0a50", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c1913a4a7948615baf636d7fdced121ef9f5d65c", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"}}, {"deprecated":false, "digest":{"function_hash":"301292263060277054030397461038633389763", "length":1340}, "id":"ASB-A-517376969-87c9eb18", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c1913a4a7948615baf636d7fdced121ef9f5d65c", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java", "function":"processMessage"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/48a7692ee59ba04e0bfb008218945b563a02ff99"], "severity":"Critical", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["124841592403275644840789695130339087578", "307831861368954435858613919994207219453", "249506482586791355484655460340221192148", "61624747918641449757092554421007486290", "211118586674546394291973253585729862836"], "threshold":0.9}, "id":"ASB-A-517376969-19663045", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/48a7692ee59ba04e0bfb008218945b563a02ff99", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"}}, {"deprecated":false, "digest":{"line_hashes":["50315671740620521043018938472500526762", "327523050067873121994309737453505693200", "241093488370500292990002828214251700968", "246833169992112906115089447481380418051"], "threshold":0.9}, "id":"ASB-A-517376969-2706c6d8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/48a7692ee59ba04e0bfb008218945b563a02ff99", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"}}, {"deprecated":false, "digest":{"function_hash":"227280303737940474194613510826702972550", "length":3685}, "id":"ASB-A-517376969-878c96e3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/48a7692ee59ba04e0bfb008218945b563a02ff99", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java", "function":"decodeWapPdu"}}, {"deprecated":false, "digest":{"function_hash":"301292263060277054030397461038633389763", "length":1340}, "id":"ASB-A-517376969-eb007f1f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/48a7692ee59ba04e0bfb008218945b563a02ff99", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java", "function":"processMessage"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/1ef3b426c5adf33c4384b363763f4b4cb30a193f"], "severity":"Critical", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"302273387230228718561017841354946272990", "length":3594}, "id":"ASB-A-517376969-4204334c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/1ef3b426c5adf33c4384b363763f4b4cb30a193f", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java", "function":"decodeWapPdu"}}, {"deprecated":false, "digest":{"function_hash":"301292263060277054030397461038633389763", "length":1340}, "id":"ASB-A-517376969-a1a4d2bb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/1ef3b426c5adf33c4384b363763f4b4cb30a193f", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java", "function":"processMessage"}}, {"deprecated":false, "digest":{"line_hashes":["124841592403275644840789695130339087578", "307831861368954435858613919994207219453", "249506482586791355484655460340221192148", "61624747918641449757092554421007486290", "211118586674546394291973253585729862836"], "threshold":0.9}, "id":"ASB-A-517376969-d5567218", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/1ef3b426c5adf33c4384b363763f4b4cb30a193f", "target":{"file":"src/java/com/android/internal/telephony/WapPushOverSms.java"}}, {"deprecated":false, "digest":{"line_hashes":["50315671740620521043018938472500526762", "327523050067873121994309737453505693200", "241093488370500292990002828214251700968", "246833169992112906115089447481380418051"], "threshold":0.9}, "id":"ASB-A-517376969-efe7edf9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/1ef3b426c5adf33c4384b363763f4b4cb30a193f", "target":{"file":"src/java/com/android/internal/telephony/InboundSmsHandler.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}