CVE-2026-55256

CVE-2026-55256 is an improper input validation flaw in the parsePartHeaders routine of Android, which parses message part headers; malformed content processed by this parser can trigger a persistent denial of service. It can be triggered remotely, with no attacker privileges and no user interaction required, by delivering crafted data to the affected parsing code. An attacker gains a sustained, persistent denial-of-service condition on the affected device or component; no code execution, privilege escalation, or data exposure is described. Any Android build containing the vulnerable parsing code is affected, but the available data does not specify which Android versions or ranges are impacted. There is currently no known exploitation, no public proof of concept, a low predicted exploitation probability (EPSS 0.2%, 5th percentile), and the flaw is not in the CISA KEV catalog.

What to do: Apply Android security updates from Google or your device OEM as soon as they reach your devices, including the September 2026 security update cycle, and confirm the installed security patch level in device settings afterward. No workaround is specified in the available data; prioritize devices that ingest remote content automatically (e.g., email or messaging services), since exploitation needs no user interaction or privileges. Monitor the Android security bulletin and OEM advisories for the concrete patched versions once published.