CVE-2026-58868
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVSS
- —
- EPSS
- 0.002 (11.3th percentile)
- CISA KEV
- Not listed
- Exploitation
- none
- Public exploits
- None seen
- State
- PUBLISHED
Coverage
The Hacker NewsSpecialist. Specialist publisher: established trade press, or expert analysis with a track record
Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and…
What we observed
No signals recorded