---
id: "CVE-2026-55288"
kind: "vulnerability"
aliases: ["CVE-2026-55288"]
title: "Android telephony: SIM record parsing flaw allows local denial of service"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "infrastructure", "mobile"]
not_affected_if: []
published_at: "2026-11-02T20:17:45+00:00"
first_seen_at: "2026-11-02T20:35:30+00:00"
updated_at: "2026-11-02T20:39:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55288", "first_seen_at": "2026-11-02T20:35:30+00:00"}]
---

# Android telephony: SIM record parsing flaw allows local denial of service

A flaw in the Android SIM record parser (SIMRecords.java, validEfCfis) throws an uncaught exception that can crash the telephony component. The description says this could lead to local privilege escalation without extra execution privileges or user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T20:35:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55288

## From the sources

In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_