CVE-2016-7989

CVE-2016-7989 is a denial-of-service vulnerability affecting Samsung Galaxy S4 through S7 devices. A remotely sent, malformed OTA WAP PUSH SMS containing an OMACP message triggers an unhandled ArrayIndexOutOfBoundsException, causing the Android runtime to crash repeatedly. This renders the device unusable until a factory reset is performed. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a high-severity issue that can be exploited remotely without user interaction, leading to a complete loss of availability for the affected device. Its EPSS score is low, suggesting a low likelihood of exploitation in the wild. There is no known active exploitation, and no public exploit code is available in Metasploit or ExploitDB. While there is limited community discussion and media coverage, one article highlights its potential for ransomware attacks.