CVE-2026-49932

CVE-2026-49932 is a heap-based buffer overflow (out-of-bounds read, CWE-122) in the parseParts function of PduParser.java, part of the Android telephony/MMS PDU-parsing stack. The flaw is triggered when a crafted or malformed PDU is parsed, and exploitation requires no user interaction and no additional execution privileges, making it reachable by a low-privileged local attacker. A successful exploit yields local escalation of privilege, with confidentiality, integrity, and availability impact scored high in the CVSS vector. All Android devices carrying the vulnerable AOSP telephony code are affected, though specific affected version ranges were not provided in the available data. There is no evidence of exploitation so far: no public proof-of-concept is known, the flaw is not in CISA's KEV catalog, EPSS puts the 30-day exploitation probability at 0.1%, and a fix shipped in the September 2026 Android Security Update.

What to do: Install the September 2026 Android security patch (or the OEM/carrier build incorporating it) on all managed Android devices, and verify the reported security patch level via MDM or Settings > About phone. Since no public PoC or in-the-wild exploitation is known, near-term risk is low, but the flaw sits in always-on PDU parsing code, so prioritize patching devices handling sensitive data.