CVE-2026-55265: Critical Out of Bounds Read in Android PduParser Package
Summary
CVE-2026-55265: In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. Affects platform/development across 6 version ranges.
>= 14:0, < 14:2026-10-01
>= 15:0, < 15:2026-10-01
>= 16:0, < 16:2026-10-01
>= 16-qpr2:0, < 16-qpr2:2026-10-01
>= 17:0, < 17:2026-10-01
>= 17-next:0, < 17-next:2026-10-01
Fixed in 17-next:2026-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PduParser package is a component of the Android ecosystem responsible for parsing multimedia messaging service (MMS) protocol data units. It plays a crucial role in handling multimedia messages, ensuring that data is correctly interpreted and displayed to users. However, this package has been found to contain a critical vulnerability that can lead to denial of service (DoS) attacks, affecting the stability and security of applications relying on it.
Vulnerability Detail
The vulnerability arises from multiple functions within the PduParser.java file, where a missing bounds check can lead to an out of bounds read. This flaw can be exploited remotely, allowing an attacker to cause a denial of service without requiring any additional execution privileges or user interaction. The potential ramifications include application crashes and service interruptions, which can significantly impact user experience and application reliability.
How To Fix
Minimum fixed version
17-next:2026-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that the data being processed by the PduParser does not exceed expected bounds. This can help mitigate the risk of exploitation until the package is updated. Example code for input validation:
if (inputData.length() > MAX_LENGTH) {
throw new IllegalArgumentException("Input data exceeds maximum length.");
}
Conclusion
In summary, CVE-2026-55265 is a critical vulnerability in the Android PduParser package that can lead to denial of service attacks. It is crucial to update the affected packages to the patched versions to ensure the security and stability of applications. Implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for platform/development →
FAQ
CVE-2026-55265 is a critical vulnerability in the Android PduParser package that allows for out of bounds reads, potentially leading to denial of service.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By checking your gradle.lockfile, Vulert can alert you to any vulnerabilities, including CVE-2026-55265.
Exploitation of this vulnerability can lead to application crashes and service interruptions, severely affecting user experience.
Yes, a patch is available. Update to version 17-next:2026-10-01 or later for the affected packages.
Implement input validation to ensure that data processed by the PduParser does not exceed expected bounds, which can help mitigate risks until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/development.
