MMS Exploit Part 5: Defeating Android ASLR, Getting RCE
Summary: Project Zero's Mateusz Jurczyk published the fifth and final post in a series on a zero-click MMS exploit against Samsung flagship devices, chaining a Qmage codec buffer overflow into an ASLR oracle that leaks memory through MMS delivery reports. He found that Android's 2 GB CFI shadow region is readable and can be located in 2 to 36 oracle queries, then bounded with binary search in 21 to 55 queries, and that linker64 loads with low address entropy relative to the shadow.
What you should know: The exploit was designed to run within roughly 480 oracle queries, about 480 minutes, which the author framed as fitting inside a user's night sleep for a zero-click attack. CFI, a mitigation, was not even enabled for the exploited libhwui.so library, so it worked solely in the attacker's favor.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026