CVE-2026-58773

Imagine a program that loads a GNSS (satellite/navigation) image. Because it’s missing a boundary check, it may write to memory locations it shouldn’t—like putting data into the wrong part of a notebook’s pages. If someone already has very high access on the device, this can help them gain even more control, without needing you to click or do anything.

This primarily matters if you run or administer Android devices where an attacker could gain local code execution that reaches “System execution privileges.” It’s not a typical remote internet risk, and it does not rely on user clicks. Based on the available findings, exploitation depends on local access with System execution privileges (reachability is not known in default configurations).

This is RED because limited, targeted exploitation has been reported, meaning real attackers have already found a workable path. The weakness allows privilege escalation after a local attacker reaches very high (System execution) capability, so successful compromise can quickly become full device control. Act as if devices you manage may already be at risk if local high-privilege access can be obtained.