CVE-2026-58868

No known exploitation. No EPSS score yet. No fix published yet.

CVSS —Not scored EPSS percentile—No score yet CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-11-02Updated 2026-11-03Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Google AndroidAffected: 17Upgrade to: not statedAffected: 16-qpr2Upgrade to: not statedAffected: 16Upgrade to: not statedAffected: 15Upgrade to: not stated + 1 more branchStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which Android devices your business uses and their current security patch level.
Watch for an official Android Security Bulletin referencing CVE-2026-58868.
Apply the vendor's monthly security update as soon as it becomes available.
Until a patch is confirmed, avoid exposing devices to untrusted media files or links from unknown sources.

May need vendor or contractor work

What it is

From the CVE record

In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

In plain language

Written by AI from the record

This is a flaw in Android's media-decoding code that could let an attacker take over a device remotely, but there's no sign it's being used in attacks and no fix is confirmed yet, so there's no need to panic right now.

Heap buffer overflow (out-of-bounds write) in FrameDecoder.cpp's onOutputReceived during media frame decoding could allow remote code execution with no privileges or user interaction required, though no exploit or patch availability is currently confirmed.

If you're affected

Device takeover risk
Data exposure on compromised devices
Operational disruption if exploited

What is it

Think of this like a flaw in the part of a phone or tablet that unpacks video/audio data — if a corrupted piece of media is received, it could overflow a memory buffer and let an outsider run their own code on the device. In theory this needs no password and no click from the user, which is why it sounds alarming, but right now there's no evidence anyone is actually using this trick.

Who is affected

This matters to you if your business uses Android phones or tablets for work, since the flaw sits in a core Android media-processing component rather than a specific app. The real-world risk depends on which Android version and patch level your devices are running, and on a vendor update becoming available to confirm and close the gap.

How urgent is it

There is no confirmed exploitation, no public exploit code, and this vulnerability is not on CISA's known-exploited list, so there's no immediate emergency. Treat this as something to track and patch when an update arrives, not something requiring urgent action today.

What to do — in detail

To confirm exposure, inventory the Android build/security-patch dates across managed devices and compare against the eventual Android Security Bulletin entry for CVE-2026-58868 once published — no fix version is currently documented in available findings. There is no public PoC or in-the-wild exploitation reported, and the CVE is not in CISA KEV, so there is no mandated remediation deadline. As a temporary measure, restrict devices from processing untrusted media streams/files (e.g., via MDM policies limiting app sources and messaging attachments) until an OEM/Google patch lands. Monitor Android Security Bulletins and your device vendor's update channel for the fix, and apply it via standard OTA/MDM patch management as soon as released.

Technical context

Weakness type: heap-based out-of-bounds write (CWE-787) in native media decoding code (FrameDecoder.cpp, onOutputReceived). Attack vector: remote, triggered via crafted media frame data processed by the decoder; no privileges or user interaction required per the vulnerability description, which raises theoretical severity. Exploitation status: no public exploit code, no KEV listing, no confirmed in-the-wild activity — exploit maturity is effectively theoretical at this time. EPSS data not provided in findings. Patch status: no fix information currently available; monitor for Android Security Bulletin coverage.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

CISA KEV: Not in the catalog. CISA has not confirmed exploitation.
Public exploits: No public exploit or proof of concept found in the sources we track.
EPSS: No EPSS score yet. New CVEs are usually scored within a few days.