---
id: "CVE-2026-58807"
page: "https://infrastack.ai/live/CVE-2026-58807"
kind: "vulnerability"
aliases: ["CVE-2026-58807"]
title: "Android MtsMessageController leaks message objects, enabling remote memory exhaustion denial of service"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "other"]
not_affected_if: []
published_at: "2026-11-10T20:19:27+00:00"
first_seen_at: "2026-11-10T20:46:11+00:00"
updated_at: "2026-11-10T20:50:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58807", "first_seen_at": "2026-11-10T20:46:11+00:00"}]
exploit_sources: []
---

# Android MtsMessageController leaks message objects, enabling remote memory exhaustion denial of service

Link for people: https://infrastack.ai/live/CVE-2026-58807 (this .md is for agents)

A logic error in the Retry_MtsMessageInPending routine of MtsMessageController.cpp leaks message objects, so memory is gradually used up. An attacker can trigger this remotely to crash or stall the affected device without needing any privileges or user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58807

## From the sources

In Retry_MtsMessageInPending of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via leaked message objects due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_