{"id":"CVE-2026-59603","kind":"vulnerability","aliases":["CVE-2026-59603"],"related":[],"title":"Android-style message controller: double free lets remote attacker crash process","description":"In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger a double free and process abort during message retry handling due to a use after free. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"In RespondReceivedMessage in MtsMessageController.cpp, a use-after-free during message retry handling leads to a double free. The result is a process abort that an attacker can trigger remotely without privileges or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mts-message-controller","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:30+00:00","first_seen_at":"2026-11-10T20:46:13+00:00","triaged_at":"2026-11-10T20:49:47+00:00","updated_at":"2026-11-10T20:49:47+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T20:49:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Android-style message controller: double free lets remote attacker crash process","impact":"low","summary":"In RespondReceivedMessage in MtsMessageController.cpp, a use-after-free during message retry handling leads to a double free. The result is a process abort that an attacker can trigger remotely without privileges or user interaction.","audience":"businesses","category":"other","nicknames":[],"who_cares":["mts-message-controller"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"remote denial of service via process abort","analyst_note":"Identify the vendor and product containing MtsMessageController.cpp from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-59603) and confirm affected versions and fix.","how_to_check":"unknown","plain_action":"","product_name":"MtsMessageController.cpp","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":4539,"output_tokens":394,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59603':15A,18A 'abort':46B,74C 'addit':95C 'android':2A 'android-styl':1A 'attack':10A,49B 'control':5A,22B 'could':86C 'crash':11A 'cve':13A,16A 'denial':90C 'doubl':6A,39B,70C 'due':79C 'execut':96C 'exploit':105C 'free':7A,31B,40B,71C,84C 'handl':35B,78C 'interact':57B,100C 'lead':36B,87C 'let':8A 'messag':4A,21B,33B,76C 'mts':20B 'mts-message-control':19B 'mtsmessagecontroller.cpp':26B,61C 'need':98C,103C 'possibl':65C 'privileg':54B,97C 'process':12A,45B,73C 'remot':9A,52B,89C 'respondreceivedmessag':24B,59C 'result':42B 'retri':34B,77C 'servic':92C 'style':3A 'trigger':51B,68C 'use':29B,82C 'use-after-fre':28B 'user':56B,99C 'way':66C 'without':53B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mtsmessagecontroller","other","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-59603':15A,18A 'android':2A 'android-styl':1A 'attack':10A 'control':5A 'crash':11A 'cve':13A,16A 'doubl':6A 'free':7A 'let':8A 'messag':4A 'process':12A 'remot':9A 'style':3A","search_b":"'abort':46B 'attack':49B 'control':22B 'doubl':39B 'free':31B,40B 'handl':35B 'interact':57B 'lead':36B 'messag':21B,33B 'mts':20B 'mts-message-control':19B 'mtsmessagecontroller.cpp':26B 'privileg':54B 'process':45B 'remot':52B 'respondreceivedmessag':24B 'result':42B 'retri':34B 'trigger':51B 'use':29B 'use-after-fre':28B 'user':56B 'without':53B","search_c":"'abort':74C 'addit':95C 'could':86C 'denial':90C 'doubl':70C 'due':79C 'execut':96C 'exploit':105C 'free':71C,84C 'handl':78C 'interact':100C 'lead':87C 'messag':76C 'mtsmessagecontroller.cpp':61C 'need':98C,103C 'possibl':65C 'privileg':97C 'process':73C 'remot':89C 'respondreceivedmessag':59C 'retri':77C 'servic':92C 'trigger':68C 'use':82C 'user':99C 'way':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59603","severity":null,"published_at":"2026-11-10T20:19:30+00:00","modified_at":"2026-11-10T20:19:30+00:00","first_seen_at":"2026-11-10T20:46:13+00:00","fetched_at":"2026-11-10T20:46:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}