CVE-2026-58859 AI-generated analysis

platform/packages/modules/Telephony, TS.43 entitlement phone number retrieval (Ts43PhoneNumberRetriever / Ts43PhoneNumberController)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Changes catch (Exception) to catch (Throwable) in Ts43PhoneNumberRetriever.fetchPhoneNumber and adds a new catch (Throwable) in the Ts43PhoneNumberController fetch method, so a StackOverflowError from JSON parsing of a server response no longer escapes and crashes the process.

Root cause

Per the commit message, a deeply nested JSON response from the TS.43 server causes unbounded recursion in JSONTokener during the phone number fetch. The tests model this as a StackOverflowError thrown from Ts43Operation.getPhoneNumber in step 3 (getPhoneNumberWithToken). A StackOverflowError is a java.lang.Error, not an Exception, so the existing catch (Exception e) in Ts43PhoneNumberRetriever.fetchPhoneNumber did not catch it. The caller in Ts43PhoneNumberController only caught ServiceEntitlementException, so the Error escaped and crashed the process. In the controller, the per-subscription in-progress flag (mIsTs43QueryInProgressPerSub) is set before the try block. An escaping Error skipped queryCompleted, so that state was not released, as the new controller test shows.

How the fix works

• framework/java/com/android/internal/telephony/Ts43PhoneNumberRetriever.java:fetchPhoneNumber: the fallback handler catch (Exception e) becomes catch (Throwable e). It logs and returns null, so any Error (including a StackOverflowError) becomes a null result. ServiceEntitlementException is still caught first and rethrown unchanged.
• framework/java/com/android/internal/telephony/Ts43PhoneNumberController.java (the fetch method that calls mTs43PhoneNumberRetriever.fetchPhoneNumber(subId), around line 220): a new catch (Throwable t) is added after catch (ServiceEntitlementException e). It logs and calls queryCompleted(subId), which releases the per-sub in-progress state, so later fetches for that subId are not skipped. Unlike the ServiceEntitlementException path, it does not call handleFetchFailure.
• Tests: Ts43PhoneNumberRetrieverTest.testFetchPhoneNumber_Failure_ThrowsThrowable (getPhoneNumber throws StackOverflowError, fetchPhoneNumber returns null) and Ts43PhoneNumberControllerTest.testFetch_unexpectedError_releasesLock (the first fetch throws StackOverflowError, the second fetch still runs and sets the number).

Completeness

• The fix only contains the failure. This commit does not bound or change the JSON parsing itself (JSONTokener recursion depth). The deep recursion still happens, and the resulting StackOverflowError is now caught and turned into a null result.
• Both layers are covered. The retriever catches Throwable inside fetchPhoneNumber. The controller catches Throwable around the whole fetch/format/set sequence, so Errors raised in formatNumber or setTs43PhoneNumber (other than the already handled NoSuchMethodError) are also contained and the per-sub lock is released.
• Only the TS.43 phone number path in this module changes. This commit does not touch any other users of the same entitlement/JSON parsing code, and the material does not show them.

Behavior changes

• An Error during phone number retrieval now makes fetchPhoneNumber return null (logged as an unexpected exception) instead of crashing the process.
• In the controller, an unexpected Throwable is now logged and followed by queryCompleted(subId), which releases the in-progress state. handleFetchFailure is not called for it, unlike ServiceEntitlementException.
• Catching Throwable also swallows other Errors (for example OutOfMemoryError) in this path. They are now logged and treated as a failed fetch.

Per major

• Android 14: not affected per the bulletin; code absent: the patched files are not in android-security-14.0.0_r30
• Android 15: not affected per the bulletin; code absent: the patched files are not in android-security-15.0.0_r18
• Android 16: not affected per the bulletin; code absent: the patched files are not in android-security-16.0.0_r9
• Android 17: same fix: commit e04c40c70a08 (cherry-pick of de8c73c03104, Change-Id Ieef53664f3a25a2286c24d0b12c3132cfe94f562) in android-security-17.0.0_r1; all 8/8 lines of the patched region are present at android-security-17.0.0_r2

Unknowns

• Where exactly the JSONTokener recursion happens (presumably inside Ts43Operation.getPhoneNumber or the service entitlement library) is not shown, nor whether that parser was hardened separately.
• The name of the controller method that contains the patched try block is not visible in the provided context.
• The body of handleFetchFailure, and whether it clears the in-progress flag, is not shown.
• The material does not say which process hosts Ts43PhoneNumberController, so it does not show what crashed.
• Whether the fix is also delivered through a module update is not shown in the material.

Back to October 2026 · Findings