AI analysis
CVE-2026-49932 is a heap-based buffer overflow (out-of-bounds read, CWE-122) in the parseParts function of PduParser.java, part of the Android telephony/MMS PDU-parsing stack. The flaw is triggered when a crafted or malformed PDU is parsed, and exploitation requires no user interaction and no additional execution privileges, making it reachable by a low-privileged local attacker. A successful exploit yields local escalation of privilege, with confidentiality, integrity, and availability impact scored high in the CVSS vector. All Android devices carrying the vulnerable AOSP telephony code are affected, though specific affected version ranges were not provided in the available data. There is no evidence of exploitation so far: no public proof-of-concept is known, the flaw is not in CISA's KEV catalog, EPSS puts the 30-day exploitation probability at 0.1%, and a fix shipped in the September 2026 Android Security Update.
What to do: Install the September 2026 Android security patch (or the OEM/carrier build incorporating it) on all managed Android devices, and verify the reported security patch level via MDM or Settings > About phone. Since no public PoC or in-the-wild exploitation is known, near-term risk is low, but the flaw sits in always-on PDU parsing code, so prioritize patching devices handling sensitive data.
Affected
| Google Android (AOSP telephony/MMS PDU parsing, PduParser.java) | — |
Estimated exposure
massbillions of Android devices (effectively the global Android installed base, roughly 3 billion+ active devices) — The vulnerable PduParser code ships in the AOSP telephony stack present on essentially all Android phones, and Android's global active-device base is in the billions; the count of still-unpatched devices depends on OEM and carrier patch…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In parseParts of PduParser.java, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.