CVE-2026-58868 In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed....
CriticalCVSS 9.8
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Android | = 17 | No fix listed |
| Google Android | = 16-qpr2 | No fix listed |
| Google Android | = 16 | No fix listed |
| Google Android | = 15 | No fix listed |
| Google Android | = 14 | No fix listed |
| Google Android | = 14.0 | No fix listed |
| Google Android | = 15.0 | No fix listed |
| Google Android | = 16.0 | No fix listed |
| Google Android | = 16.0-qpr2 | No fix listed |
| Google Android | = 17.0 | No fix listed |
References
- source.android.com patch vendor-advisory