AI analysis
CVE-2026-55256 is an improper input validation flaw in the parsePartHeaders routine of Android, which parses message part headers; malformed content processed by this parser can trigger a persistent denial of service. It can be triggered remotely, with no attacker privileges and no user interaction required, by delivering crafted data to the affected parsing code. An attacker gains a sustained, persistent denial-of-service condition on the affected device or component; no code execution, privilege escalation, or data exposure is described. Any Android build containing the vulnerable parsing code is affected, but the available data does not specify which Android versions or ranges are impacted. There is currently no known exploitation, no public proof of concept, a low predicted exploitation probability (EPSS 0.2%, 5th percentile), and the flaw is not in the CISA KEV catalog.
What to do: Apply Android security updates from Google or your device OEM as soon as they reach your devices, including the September 2026 security update cycle, and confirm the installed security patch level in device settings afterward. No workaround is specified in the available data; prioritize devices that ingest remote content automatically (e.g., email or messaging services), since exploitation needs no user interaction or privileges. Monitor the Android security bulletin and OEM advisories for the concrete patched versions once published.
Affected
| Google (Android / AOSP; CNA: [email protected]) Android - message part header parsing (parsePartHeaders, multiple files) | — |
Estimated exposure
massbillions of Android devices potentially affected (Android's global install base); exact count unknown — Android runs on an ecosystem of roughly three billion-plus active devices worldwide, so a flaw in a core Android parsing routine plausibly touches ecosystem-scale populations, though the data does not identify which builds carry the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.