CVE-2026-58868

CVE Enrichment

CISA KEV: Not listed

Description

In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Technical Details

CNA / NVD Source: [email protected]
Published: 03-Nov-2026 03:17
Last Modified: 03-Nov-2026 12:18

CNA Products / Version Status

Google · Android Source: CNA · [email protected]
Default status: unaffected

17 — affected
16-qpr2 — affected
16 — affected
15 — affected
14 — affected

References

[email protected]

Last enrichment sync: 03-Nov-2026 20:31
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

According to Google’s security bulletin, the most severe of the patched weaknesses resides in the Framework component and is tracked as CVE-2026-58868. Google’s November 2026 Android Updates Patch More Than 200 Vulnerabilities

Vendors (6)

Products (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.