{"id":"CVE-2026-58807","kind":"vulnerability","aliases":["CVE-2026-58807"],"related":[],"title":"Android MtsMessageController leaks message objects, enabling remote memory exhaustion denial of service","description":"In Retry_MtsMessageInPending of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via leaked message objects due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A logic error in the Retry_MtsMessageInPending routine of MtsMessageController.cpp leaks message objects, so memory is gradually used up. An attacker can trigger this remotely to crash or stall the affected device without needing any privileges or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:27+00:00","first_seen_at":"2026-11-10T20:46:11+00:00","triaged_at":"2026-11-10T20:50:13+00:00","updated_at":"2026-11-10T20:50:13+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T20:50:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Android MtsMessageController leaks message objects, enabling remote memory exhaustion denial of service","impact":"low","summary":"A logic error in the Retry_MtsMessageInPending routine of MtsMessageController.cpp leaks message objects, so memory is gradually used up. An attacker can trigger this remotely to crash or stall the affected device without needing any privileges or user interaction.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"remote denial of service through memory exhaustion on the device","analyst_note":"Confirm the affected Android component, versions and patch level from the NVD entry and the Android security bulletin; the product is not named in the sources.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":4549,"output_tokens":386,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-58807':15A,18A 'addit':92C 'affect':50B 'android':1A,19B 'attack':40B 'could':83C 'crash':46B 'cve':13A,16A 'denial':10A,87C 'devic':51B 'due':77C 'enabl':6A 'error':22B,81C 'execut':93C 'exhaust':9A,72C 'exploit':102C 'gradual':36B 'interact':58B,97C 'lead':84C 'leak':3A,30B,74C 'logic':21B,80C 'memori':8A,34B,71C 'messag':4A,31B,75C 'mtsmessagecontrol':2A 'mtsmessagecontroller.cpp':29B,63C 'mtsmessageinpend':26B,61C 'need':53B,95C,100C 'object':5A,32B,76C 'possibl':67C 'privileg':55B,94C 'remot':7A,44B,86C 'retri':25B,60C 'routin':27B 'servic':12A,89C 'stall':48B 'trigger':42B,70C 'use':37B 'user':57B,96C 'via':73C 'way':68C 'without':52B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","other","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-58807':15A,18A 'android':1A 'cve':13A,16A 'denial':10A 'enabl':6A 'exhaust':9A 'leak':3A 'memori':8A 'messag':4A 'mtsmessagecontrol':2A 'object':5A 'remot':7A 'servic':12A","search_b":"'affect':50B 'android':19B 'attack':40B 'crash':46B 'devic':51B 'error':22B 'gradual':36B 'interact':58B 'leak':30B 'logic':21B 'memori':34B 'messag':31B 'mtsmessagecontroller.cpp':29B 'mtsmessageinpend':26B 'need':53B 'object':32B 'privileg':55B 'remot':44B 'retri':25B 'routin':27B 'stall':48B 'trigger':42B 'use':37B 'user':57B 'without':52B","search_c":"'addit':92C 'could':83C 'denial':87C 'due':77C 'error':81C 'execut':93C 'exhaust':72C 'exploit':102C 'interact':97C 'lead':84C 'leak':74C 'logic':80C 'memori':71C 'messag':75C 'mtsmessagecontroller.cpp':63C 'mtsmessageinpend':61C 'need':95C,100C 'object':76C 'possibl':67C 'privileg':94C 'remot':86C 'retri':60C 'servic':89C 'trigger':70C 'user':96C 'via':73C 'way':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58807","severity":null,"published_at":"2026-11-10T20:19:27+00:00","modified_at":"2026-11-10T20:19:27+00:00","first_seen_at":"2026-11-10T20:46:11+00:00","fetched_at":"2026-11-10T20:46:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}