{"id":"CVE-2026-58865","published":"2026-10-05T19:17:25.183","lastModified":"2026-10-07T15:14:22.670","description":"In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-119"],"vendors":["google"],"products":["android"],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is a missing bounds check in PduParser.java that can lead to persistent denial of service when processing SMS PDUs. This affects Google's Android platform and allows remote attackers to cause system unresponsiveness without needing any privileges or user interaction.","exploitability":"Exploitation is straightforward with no prerequisites needed as the vulnerability is remotely triggerable through malformed SMS PDUs without requiring user interaction or additional execution privileges.","blast_radius":"The impact could be significant across Android devices that process SMS messages, potentially causing widespread service disruption on affected platforms.","remediation":"Upgrade to Android Security Patch Level 2026-05-05 or later, which contains the fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","sms","android"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:03:13.556Z"}}