Google Android: Memory exhaustion via leaked message objects
Summary
A logic error in Retry_MtsMessageInPending in MtsMessageController.cpp in the Android kernel leaks message objects. A remote attacker can exhaust device memory and cause a denial of service without user interaction or additional privileges. The CVE record lists CISA SSVC as automatable with partial technical impact, and no source reports exploitation.
Affected
- Google Android, affected Android kernel component (per CVE record)
- Exact affected versions: Unknown.
Fixed in
- Pixel Update Bulletin November 2026, security patch level 2026-11-05 or later
- Not confirmed: CVE-2026-58807 was not found in the bulletin excerpts reviewed, so verify it in the full bulletin table.
Workaround
Unknown. No workaround is documented. Apply the security patch level.
Exploitation
- No evidence of exploitation in the wild found.
- A third-party tracker lists it as not in CISA KEV; CISA KEV was not checked directly.
- No public proof of concept found.
Our recommendation
- Install the security patch level 2026-11-05 or later on all Android devices used for work.
- Enforce the patch level via MDM and track devices that are behind.
- Prioritise internet-facing or widely exposed devices.
- Verify the fix against the full Pixel bulletin table and the NVD entry.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record CVE-2026-58807 www.cve.org
- Pixel Update Bulletin November 2026 source.android.com
- 9to5Google November 2026 Pixel update rollout 9to5google.com
- techinkey November 2026 Pixel update delay techinkey.com
- strix.ai CVE-2026-58807 (third-party, status only) www.strix.ai
- threatint CVE-2026-58807 (third-party, status only) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:57.
Original description (NVD)
In Retry_MtsMessageInPending of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via leaked message objects due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.