PUB-A-517375803: Use After Free

Q: What level of access does an attacker need to trigger this issue?

The issue can be exploited remotely with no additional execution privileges. It does not require user interaction.

Q: What is the expected impact of successful exploitation?

Successful exploitation can cause a double free and process abort during message retry handling, resulting in remote denial of service.

Published Nov 1, 2026

Updated

In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger a double free and process abort during message retry handling due to a use after free. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

1 affected componentFixes available

android/:unknown:>=Pixel-family specific:0<Pixel-family specific:2026-11-05

Pixel-family specific:2026-11-05

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

What level of access does an attacker need to trigger this issue?

The issue can be exploited remotely with no additional execution privileges. It does not require user interaction.

What is the expected impact of successful exploitation?

Successful exploitation can cause a double free and process abort during message retry handling, resulting in remote denial of service.

PUB-A-517375803: Use After Free

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to trigger this issue?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to trigger this issue?

What is the expected impact of successful exploitation?