CriticalCVECVE-2026-58868
Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
The Hacker News·Source published ·1 min read
What happened?
A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules.
Key details
- Critical Android flaw CVE-2026-58868 enables remote code execution without user interaction.
- The vulnerability affects Android versions 14 through 17 and is fixed in security patch level 2026-11-01 or later.
- The flaw is a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp causing an out-of-bounds write.
- Google reports no active exploitation of the November bulletin flaws as of November 4, and none are in CISA's Known Exploited Vulnerabilities catalog.
- Another critical flaw CVE-2026-58882 in WAP Push SMS handling allows remote denial-of-service and can crash phones on startup.
Affected
- Android 14 through 17 are affected by CVE-2026-58868.
- Android 12 and 13 run the same vulnerable code for CVE-2026-58882 but do not receive the fix.
Fixes and mitigations
- Some fixes for Android 10 or later may arrive via Google Play system updates, including CVE-2026-58876.
What to look for
- A malformed WAP Push SMS crashes com.android.phone and ends active calls including emergency calls.
- The malicious SMS never appears in the inbox and the phone retries the message on each startup causing repeated crashes.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.