Read the docs
TI-2022-21325 Aliases CVE-2022-43543GHSA-jxxq-8qw2-56g4

Improper output encoding in KDDI +Message App for Android and for iOS, NTT DOCOMO…

Priority LOW 25CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

KDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode control characters. +Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character's specifications. Therefore, a crafted text may display misleading web links. As a result, a spoofed URL may be displayed and phishing attacks may be conducted. Affected products and versions are as follows: KDDI +Message App for Android prior to version 3.9.2 and +Message App for iOS prior to version 3.9.4, NTT DOCOMO +Message App for Android prior to version 54.49.0500 and +Message App for iOS prior to version 3.9.4, and SoftBank +Message App for Android prior to version 12.9.5 and +Message App for iOS prior to version 3.9.4

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00521 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KDDI CORPORATION, NTT DOCOMO, INC., and SoftBank Corp.KDDI +Message App for Android and for iOS, NTT DOCOMO +Message App for Android and for iOS, and SoftBank +Message App for Android and for iOSKDDI +Message App for Android prior to version 3.9.2 and +Message App for iOS prior to version 3.9.4, NTT DOCOMO +Message App for Android prior to version 54.49.0500 and +Message App for iOS prior to version 3.9.4, and SoftBank +Message App for Android prior to version 12.9.5 and +Message App for iOS prior to version 3.9.4—No fix listedCNA
  • KDDI +Message App for Android and for iOS, NTT DOCOMO +Message App for Android and for iOS, and SoftBank +Message App for Android and for iOS VendorKDDI CORPORATION, NTT DOCOMO, INC., and SoftBank Corp. Affected KDDI +Message App for Android prior to version 3.9.2 and +Message App for iOS prior to version 3.9.4, NTT DOCOMO +Message App for Android prior to version 54.49.0500 and +Message App for iOS prior to version 3.9.4, and SoftBank +Message App for Android prior to version 12.9.5 and +Message App for iOS prior to version 3.9.4 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:docomo:\+_message:*:*:*:*:*:iphone_os:*:*before 3.9.4VulnerableDocomo
cpe:2.3:a:docomo:\+_message:*:*:*:*:*:android:*:*before 54.49.0500VulnerableDocomo
cpe:2.3:a:kddi:\+_message:*:*:*:*:*:android:*:*before 3.9.2VulnerableKDDI CORPORATION
cpe:2.3:a:kddi:\+_message:*:*:*:*:*:iphone_os:*:*before 3.9.4VulnerableKDDI CORPORATION
cpe:2.3:a:softbank:\+_message:*:*:*:*:*:iphone_os:*:*before 3.9.4VulnerableSoftBank Corp.
cpe:2.3:a:softbank:\+_message:*:*:*:*:*:android:*:*before 12.9.5VulnerableSoftBank Corp.
  • cpe:2.3:a:docomo:\+_message:*:*:*:*:*:iphone_os:*:* Versions before 3.9.4 Vulnerable ·Docomo
  • cpe:2.3:a:docomo:\+_message:*:*:*:*:*:android:*:* Versions before 54.49.0500 Vulnerable ·Docomo
  • cpe:2.3:a:kddi:\+_message:*:*:*:*:*:android:*:* Versions before 3.9.2 Vulnerable ·KDDI CORPORATION
  • cpe:2.3:a:kddi:\+_message:*:*:*:*:*:iphone_os:*:* Versions before 3.9.4 Vulnerable ·KDDI CORPORATION
  • cpe:2.3:a:softbank:\+_message:*:*:*:*:*:iphone_os:*:* Versions before 3.9.4 Vulnerable ·SoftBank Corp.
  • cpe:2.3:a:softbank:\+_message:*:*:*:*:*:android:*:* Versions before 12.9.5 Vulnerable ·SoftBank Corp.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43543
  2. 2026-10-03 Alias added: GHSA-jxxq-8qw2-56g4

References

Advisory 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences