CVE-2026-0059

CVE Enrichment

CVSS: 8.0 HIGH
EPSS: 0.11%
EPSS Percentile: 1.45%
CISA KEV: Not listed

Description

In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 02-Jun-2026 05:16
Last Modified: 22-Jul-2026 15:10
EPSS Date: 2026-10-31
CWE: CWE-122

CVSS Vector


            CVSS:3.1                            AV:A /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

google / android Source: NVD CPE · affected
Version / affected range: 14.0
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
google / android Source: NVD CPE · affected
Version / affected range: 15.0
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
google / android Source: NVD CPE · affected
Version / affected range: 16.0
cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*
google / android Source: NVD CPE · affected
Version / affected range: 16.0
cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*
google / android Source: NVD CPE · affected
Version / affected range: 16.0
cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*
google / android Source: NVD CPE · affected
Version / affected range: 16.0
cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 01-Nov-2026 15:52
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Only one of them, a System vulnerability tracked as CVE-2026-0059, can be exploited for remote code execution. Google Patches Android Zero-Day and 123 Other Vulnerabilities

CVE (1)

Vendors (5)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.