CVE-2026-58874 Overview
CVE-2026-58874 is a local privilege escalation vulnerability in the Android SmsController.java component. Multiple functions within SmsController lack proper permission checks, allowing a local attacker with low privileges to elevate access. Exploitation requires no user interaction and no additional execution privileges. The flaw is classified under CWE-269: Improper Privilege Management and was documented in the Android Security Bulletin September 2026.
Critical Impact
A local application without special privileges can escalate to higher privileges on affected Android devices, gaining access to protected SMS functionality and associated resources.
Affected Products
- Android operating system (SMS subsystem)
- Devices incorporating the vulnerable SmsController.java component
- See the Android Security Bulletin September 2026 for the authoritative list of affected versions
Discovery Timeline
- 2026-09-08 - CVE-2026-58874 published to NVD
- 2026-09-08 - Last updated in NVD database
- September 2026 - Addressed in the Android Security Bulletin September 2026
Technical Details for CVE-2026-58874
Vulnerability Analysis
The vulnerability resides in SmsController.java, a component of the Android telephony framework responsible for handling SMS-related operations. Multiple functions in this class fail to enforce required permission checks before executing privileged operations. A local application can invoke these functions directly through the exposed interfaces without holding the permissions those operations should require.
Because the missing checks are in SmsController, an attacker can perform SMS-related actions that should be restricted to privileged callers. This includes operations that may expose message content, alter SMS state, or interact with the telephony stack in ways that bypass the Android permission model.
The flaw maps to CWE-269: Improper Privilege Management. Local access is required, complexity is low, and exploitation succeeds without user interaction. Confidentiality, integrity, and availability are all impacted at the elevated privilege level.
Root Cause
The root cause is a missing permission check in multiple entry points of SmsController.java. Android IPC boundaries require callers to be validated against declared permissions before privileged operations proceed. In the affected functions, this validation is absent, allowing any process able to reach the interface to invoke restricted behavior.
Attack Vector
An attacker deploys a malicious or compromised local application on the device. The application invokes the unprotected functions in SmsController through the standard Android binder interface. Because the framework does not verify the caller's permissions, the operations execute with the privileges of the telephony service rather than those of the calling app. No user prompt or interaction is required.
No verified public proof-of-concept code is available at this time. Refer to the Android Security Bulletin September 2026 for the associated commit references and technical details.
Detection Methods for CVE-2026-58874
Indicators of Compromise
- Unprivileged applications making unexpected calls into the telephony SmsController binder interface
- SMS-related operations attributed to processes that do not declare corresponding SMS permissions in their manifest
- Anomalous outbound SMS activity or SMS state changes not originating from the default messaging app
Detection Strategies
- Audit installed applications for those interacting with SMS APIs without holding SEND_SMS, READ_SMS, or related permissions
- Review Android system logs (logcat) for privilege-related exceptions or unusual SmsController invocations
- Use Mobile Threat Defense telemetry to flag apps performing telephony actions inconsistent with their declared capabilities
Monitoring Recommendations
- Track Android security patch level (SPL) across the managed device fleet and alert on devices below the September 2026 patch level
- Monitor enterprise app inventories for newly installed apps requesting or exercising SMS functionality
- Correlate SMS billing anomalies and premium-rate activity with device patch status to identify potential exploitation
How to Mitigate CVE-2026-58874
Immediate Actions Required
- Apply the September 2026 Android security patch level or later to all managed devices as it becomes available from device vendors
- Restrict installation of applications from untrusted sources through Mobile Device Management (MDM) policy
- Remove or block any applications requesting SMS-related permissions without a clear business justification
Patch Information
The fix is delivered through the Android Security Bulletin September 2026. Devices with a security patch level of 2026-09-01 or later include the corrected permission checks in SmsController.java. Downstream OEM availability varies; consult device-vendor advisories for specific rollout timing.
Workarounds
- Enforce MDM policies that block sideloading and restrict installs to vetted enterprise or Play Store applications
- Limit device use to trusted applications until the September 2026 SPL is installed
- Configure enterprise mobility solutions to alert on apps invoking telephony APIs outside of approved messaging clients
# Verify Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output on a patched device (or later):
# 2026-09-01
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
