Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction

CVE-2026-58868 is a critical vulnerability in Android 14 through 17. It involves the onOutputReceived function in FrameDecoder.cpp, where a heap buffer overflow can cause an out-of-bounds write. Google lists it as potentially enabling remote code execution without user interaction.

Remote code execution means an attacker may make the phone run code from a distance. The victim does not need to open a file, approve a prompt, or tap a link. The bulletin and CVE record do not explain how an attacker reaches the vulnerable code, so the delivery method remains unknown.

Google's critical rating assumes Android's built-in protections and Google's service protections are turned off or bypassed. As of November 4, Google reported no attacks exploiting its flaws, and the vulnerability was not in CISA's Known Exploited Vulnerabilities catalog. Phones need security patch level 2026-11-01 or later.

CVE-2026-58868 affects Android versions 14 through 17. Google's records do not list Android 12 or 13 as affected by this particular flaw, but they also do not explain whether those older versions contain it. That means the article does not establish their status beyond the affected-version list.

The relevant date is the Android security update date shown in the phone's Android version settings. A security patch level of 2026-11-01 or later covers CVE-2026-58868, along with the other Framework, System, and Android runtime fixes in that patch group.

A 2026-11-05 patch level covers every flaw in the November bulletin, including kernel and listed chip-component issues. Manufacturers and carriers deliver updates on their own schedules, so phones may receive the fix at different times. Google gives no workaround for phones unable to install it yet.

The November bulletin covers 216 vulnerabilities across Android components and supplier software. Google rates 23 of them Critical, meaning the release includes a substantial group of the bulletin's highest-severity issues. The scale matters because users may need a broad update, not only a fix for CVE-2026-58868.

The bulletin includes critical issues in Android's Framework, System, runtime, kernel, and other components. It also includes flaws in parts from Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm. Six Critical flaws are in the kernel, including two involving Bluetooth code.

Google had not reported attacks exploiting its flaws as of November 4. None appeared in CISA's Known Exploited Vulnerabilities catalog in its November 3 update. The 2026-11-05 patch level includes every listed fix, while 2026-11-01 covers the Android component group containing CVE-2026-58868.

The central consequence is remote code execution. If exploitation succeeded, an attacker could cause the affected phone to run code from a distance, without user interaction. That is more serious than merely displaying an error or crashing an app because the flaw could turn a memory error into active code execution.

The defect is a possible out-of-bounds write caused by a heap buffer overflow in onOutputReceived, inside FrameDecoder.cpp. Writing beyond a buffer can corrupt nearby memory. In some cases, that corruption can alter data used by the program and redirect its behavior, although the bulletin does not provide the exploit details for this flaw.

Google's Critical rating assumes Android and Google's service protections are disabled or bypassed. As of November 4, Google reported no exploitation of its flaws. The bulletin and CVE record do not say how an attacker reaches the vulnerable function, so the practical attack route remains undisclosed.

A heap buffer is a block of memory allocated while a program runs. It is meant to hold a specific amount of data. A heap buffer overflow happens when the program writes more data than that block can contain, causing a possible out-of-bounds write into adjacent memory.

The extra data may overwrite information belonging to another object or part of the program's operating state. If important control data is changed, the program may follow an attacker-influenced path instead of its intended path. That can sometimes turn a crash or corruption bug into code execution. The exact result depends on the surrounding memory and protections.

For CVE-2026-58868, Google identifies the possible out-of-bounds write in onOutputReceived within FrameDecoder.cpp. Neither Google's bulletin nor the CVE record explains how attackers reach that function or how exploitation works. Google's Critical rating assumes built-in protections are bypassed or disabled.

Android updates do not reach every phone through one release schedule. Phone makers and carriers send security fixes on their own schedules. Their separate distribution schedules explain why one device may receive a patch before another, even when both run Android.

Google uses two dates in the November bulletin. The 2026-11-01 level covers fixes common to all Android devices, including CVE-2026-58868 and flaws in Framework, System, and the Android runtime. The 2026-11-05 level covers the complete bulletin, including kernel and supplier-specific components.

This system lets manufacturers ship a shared set of fixes sooner instead of waiting for every listed component fix. Google encourages manufacturers to include all bulletin fixes. Users should check both the Android security update date and Google Play system update date, although CVE-2026-58868 requires checking the Android security update date specifically.

The bulletin also describes attacks with different outcomes. CVE-2026-58882 is a Critical remote denial-of-service flaw in decodeWapPdu, Android code that handles WAP Push messages arriving through SMS. A denial-of-service attack disrupts availability, while remote code execution makes a device run code.

A research write-up described one malformed WAP Push message crashing com.android.phone and ending active calls, including emergency calls. The message did not appear in the inbox. The phone retried it whenever it started, potentially causing crashes at startup until the message was removed. The attacker needed only the target's phone number.

The article does not establish whether CVE-2026-58882 is the same bug described in that write-up. A public proof-of-concept app can send the message between phones. The write-up says Android 12 and 13 run the same code but do not receive the newer versions' fix. The bulletin gives no workaround for phones awaiting updates.