CVE-2026-58882: Android WAP Push Remote Denial of Service

CVE-2026-58882 is a critical Android System denial-of-service vulnerability in WAP Push message decoding. The CVE Record identifies an integer overflow in decodeWapPdu in WapPushOverSms.java that can lead to an out-of-bounds read. A remote attacker does not need additional execution privileges or user interaction to trigger the affected condition.

Google lists the issue in the November 2026 Android Security Bulletin as Critical and associates it with Android 14, 15, 16, 16 QPR2 and 17. The bulletin was published on November 2, 2026 and states that security patch levels of 2026-11-05 or later address all issues in the bulletin.

The response task is not to reproduce a malicious WAP Push message. It is to determine whether each device model received the vendor correction, installed it, restarted into the corrected build and reports evidence that can be tied to the actual managed device.

Affected Android versions and impact

A denial of service can still be operationally serious when devices support field work, authentication, communications, logistics or safety-related workflows. The CVE description does not establish remote code execution, data theft or persistence. Keep those outcomes out of the incident record unless separate evidence supports them.

AOSP publication is not the same as fleet remediation

Android patch delivery has several stages. Google publishes the platform bulletin and corresponding source changes. Device manufacturers integrate applicable platform and device-specific fixes into signed builds. Carriers or enterprise approval processes may add another release gate. The device must then download, install and boot the corrected build. Finally, EMM or MDM inventory must refresh accurately enough to support closure.

A statement that an update is “available” therefore does not prove that a particular phone or rugged device is corrected. Track model, region, carrier, build fingerprint and security patch level. Devices on the same Android major version can receive updates on different schedules, and an unsupported model may never receive the required release.

Explore Penligent for authorized security testing

Collect device-level evidence

On an authorized test or managed device, Android Debug Bridge can collect read-only identity fields. Use the organization’s approved device-management method in production; developer access may be disabled by policy.

adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.fingerprint
adb shell getprop ro.product.manufacturer
adb shell getprop ro.product.model
adb shell getprop ro.build.version.release
adb shell getprop gsm.version.baseband

The Android bulletin places CVE-2026-58882 in its 2026-11-01 patch-level section. That level covers the issues associated with that section; 2026-11-05 is the broader target for all issues in the November bulletin. Tie either claim to the OEM build for the actual device.

For this bulletin, ro.build.version.security_patch should report 2026-11-05 or later when the goal is to cover every issue listed in the November bulletin. Record the full build fingerprint because the date alone does not identify the exact OEM image. Retain the device identifier, collection time and management source so the evidence cannot be confused with a laboratory handset or a different fleet cohort.

Use cohorts instead of a single fleet percentage

Temporary controls can reduce operational exposure but do not change the device’s affected software state. Mobile network behavior, messaging controls and device-management restrictions vary by environment and should not be described as universal prevention. The durable correction is a vendor build that incorporates the applicable Android fix.

Monitor without sending a malicious message

Unexpected System process crashes, repeated telephony or messaging failures, boot loops and clusters of device restarts may justify investigation, but they are not specific proof of CVE-2026-58882. Preserve device logs, crash records, MDM events, carrier support information and the installed build before factory reset or replacement when incident response requires them.

Do not send a crafted WAP Push payload to a production device to prove the patch. A safe validation checks the corrected build and patch level, confirms the device restarted, verifies ordinary SMS/MMS and business workflows, and watches for abnormal crashes after deployment.

Explore Penligent for authorized security testing

Patch verification checklist

1. Inventory every Android 14, 15, 16, 16 QPR2 and 17 device by model, carrier or region and business owner.
2. Map the OEM build that claims the November 2026 correction to each cohort.
3. Deploy the update through the approved channel and require the necessary restart.
4. Collect 2026-11-05 or later security patch level plus the full build fingerprint.
5. Verify messaging, connectivity, authentication and critical managed applications.
6. Escalate unsupported, stale or vendor-blocked devices with an owner and dated disposition.

Close the device finding with evidence

CVE-2026-58882 is a remote, no-interaction denial-of-service flaw in Android WAP Push decoding. The useful response is a model-specific patch campaign: identify affected Android versions, follow OEM and carrier delivery, install and restart the corrected build, and retain device-level patch and fingerprint evidence. Do not substitute a published AOSP fix, an available update notice or a malicious test message for proof that the managed fleet is actually corrected.

The following Penligent overview illustrates an authorized security-testing workflow. It is a general product demonstration, not a demonstration of exploiting an Android device.