NewsBleepingComputer
New Android SMS of Death exploit can remotely crash unpatched phones
Linked advisories
- CVE-2026-58882OSV-Eintrag
- CVE-2026-58882Google Android: Lesen außerhalb des zugewiesenen Speichers (Out-of-bounds Read)
- CVE-2026-58882Samsung Products Multiple Vulnerabilities
- CVE-2026-58882Google Android: Lesen außerhalb des zugewiesenen Speichers (Out-of-bounds Read)
- CVE-2026-58882Android "SMS of Death": one silent text crashes the phone service and drops calls (CVE-2026-58882)
- CVE-2026-58882Android Multiple Vulnerabilities
Affected vendors and products
More on unpatched
Other advisories
- Highpwn_watch:embrace-ai-assistant-embedded-browsers-oct-2026EMBRACE: built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop broken, Codex and VS Code still unpatched
- Criticalpwn_watch:linux-kernel-zdi-reports-leaked-to-lkmlLinux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)
- HighCVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- HighCVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- Not ratedosv:CVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- CriticalCVE-2025-59851HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, whic…
- Not ratedosv:CVE-2026-35667OpenClaw < 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.ts
- Not ratedosv:ECHO-ddb8-c818-edcaVulnerable code is not present in libraw 0.21.4 (the version shipped in Debian trixie). The CVE describes a heap out-of-bounds write in HuffTable::initval (src/decompressors/losslessjpeg.cpp), reachable via LibRaw::sony_ycbcr_load_raw -> LibRaw_LjpegDecompressor::initialize -> HuffTable::initval. None of those symbols exist in 0.21.4: the src/decompressors/ directory, the LibRaw_LjpegDecompressor class, and the sony_ycbcr_load_raw entry point were all introduced together in libraw 0.22.0. Empirically confirmed by running the public PoC from https://github.com/biniamf/pocs/tree/main/libraw_lljpeg against an ASan build of unpatched libraw 0.21.4: the file is rejected at open with "Unsupported file format or not RAW file"; the same PoC reproduces the heap-buffer-overflow in 0.22.0 with the stack trace from the Talos report.
Other news entries
- Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet CredentialsNewsThe Hacker News
- Over 1,000 GitLab servers vulnerable to ongoing RCE attacksNewsBleepingComputer
- Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatchedNewsThe Register — Security
- How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AINewsSecurityWeek
- Hackers now scanning systems for recently-patched Oracle flawNewsBleepingComputer
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other ServersNewsThe Hacker News
- PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell PatchesNewsThe Hacker News
- PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatchedNewsThe Register — Security
ID