Google patches critical Android flaw allowing remote code execution without user interaction

Google patched CVE-2026-58868, a critical Android vulnerability affecting Android 14 through 17 including Android 16 QPR2, in its November 2026 security bulletin released November 2, 2026.s

CVE-2026-58868 is a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp that can cause an out-of-bounds write. The flaw permits remote code execution without user interaction and without additional execution privileges.s

The vulnerable code sits in Android’s media playback framework and creates preview images such as video and photo thumbnails. It can take part in ordinary media-processing tasks, including generating thumbnails for received or downloaded media files. The FrameDecoder.cpp code carries a 2017 copyright header, and it is unclear when the flaw was introduced.s

Google’s November 2026 bulletin addresses 216 vulnerabilities, 23 rated Critical. Two other critical flaws in Android’s System component, CVE-2026-58876 and CVE-2026-58936, may enable remote code execution with no user interaction and are rated 9.8 out of 10. The bulletin also lists five additional Critical System flaws: three could lead to privilege escalation and two could cause denial-of-service conditions.s

Devices with a security patch level of November 1, 2026 or later receive the fix for CVE-2026-58868 and other Framework, System, and Android runtime flaws. The November 5, 2026 patch level covers all November bulletin flaws, including kernel and chipset components from Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm. It also fixes critical flaws in MediaTek modem code and a closed-source Qualcomm component tracked as CVE-2026-25285.s

Six critical kernel flaws were fixed: two in Bluetooth, three in pKVM, and one in HID. The most severe allows remote privilege escalation without user interaction.s

The Hacker News reported on November 4, 2026, that Google’s bulletin did not report attacks exploiting its flaws. None of the flaws were in CISA’s Known Exploited Vulnerabilities catalog as of its November 3, 2026 update.s

Security Affairs stated that Google is aware of active exploitation of flaws in the November 2026 bulletin. MalaysianWireless reported on November 4, 2026, that Google has not reported active exploitation of CVE-2026-58868 and two related critical flaws. No public proof-of-concept exploit for CVE-2026-58868 is available, and Google has not confirmed active exploitation in the wild.s

CVE-2026-58882 is a denial-of-service bug in decodeWapPdu for WAP Push messages sent via SMS, linked by MalaysianWireless to the SMS of Death flaw disclosed October 29, 2026, by Mark Blaszczyk. Google’s bulletin and the CVE record identify decodeWapPdu but do not confirm that CVE-2026-58882 is the researcher’s bug. Exploitation reportedly needs no user interaction beyond the victim’s phone number, and the message never appears in the inbox. A malformed WAP Push message can crash com.android.phone, ending active calls including emergency calls and forcing a restart loop until the message is removed.s

Android 12 and 13 are not listed as affected by CVE-2026-58868, and Google’s records do not say whether they contain it. Cybernews estimates 43.6% of active Android devices run Android 13 or older unsupported versions and will not receive the fix.s

Users can check the security patch level in Settings under About phone or About tablet, then Android version. Pixel users check Settings, System, Software updates for the patch. Samsung Galaxy users check Settings, Software update, then Download and install; the patch level appears under software information.s

Google’s bulletin offers no workaround for devices unable to install the update yet, and Google advises that Android devices stay on the latest supported software version. Phones running Android 10 or later may receive some fixes through Google Play system updates, but not CVE-2026-58868. Google uses two patch levels so manufacturers can ship common fixes sooner and encourages them to include every fix. Google’s Critical rating assumes Android’s built-in protections and Google services are turned off or bypassed.s

Samsung’s November 2026 update covers more than 200 flaws on Android 14 through 17, including 20 critical Google flaws, and counts 178 Google Android fixes, four Samsung Semiconductor patches, and 24 Galaxy-specific items. A separate 157 Google issues carry a high rating while one is moderate. Samsung disclosed three high and 14 moderate bugs of its own, but seven more remain private until enough devices are patched. Samsung has not shared a rollout schedule; timing depends on model, carrier, and region, with Galaxy S26 and Z Fold7 usually first.s

Samsung-specific fixes cover a bootloader flaw needing physical access, a camera filter plugin allowing arbitrary code execution after user interaction, and a stack buffer overflow in Samsung’s libsecuibc library. Moderate fixes cover weak certificate checks enabling a SIM lock bypass, cover-screen Contacts widgets that may place calls without permission, and an MKV video parser flaw. Samsung says certain chipset patches could arrive in later security releases once the fixes are ready, and Malaysian Galaxy owners should verify that their specific phone model has received the November security update. Neither Google nor Samsung says any November bug has been exploited in the wild.s

Google’s bulletin names eight critical MediaTek modem flaws, while MediaTek’s November bulletin details six: CVE-2026-20499 and CVE-2026-20545 through CVE-2026-20549. MalaysianWireless lists CVE-2026-20499, CVE-2026-20519, and CVE-2026-20520 among eight critical MediaTek modem vulnerabilities. MediaTek describes its six flaws as out-of-bounds writes stemming from improper input validation, integer overflow, or missing bounds checks, and reports no wild exploitation.s

Cybernews reports that AI-assisted attackers can reverse-engineer patches once source code is released 48 hours after the bulletin’s initial publication, and Android’s user base is nearing four billion. Researchers reported the fix existed before the November bulletin formally listed it, saying it appeared in Google’s October Android security updates.s

SlowMist’s Chief Information Security Officer 23pds posted on X urging immediate upgrades after the remote code execution flaw was added to the November security patch. Google releases patches that device makers, chip suppliers, and carriers adapt for specific models, so delivery often takes several weeks to several months after the announcement, Note.com says.s

MalaysianWireless says phone makers must build and ship the patch for newer Android devices, and older phones no longer receiving updates may remain exposed. Cybernews reports that budget phones past their promised update window may never receive the November patch. Note.com says that for models whose manufacturer security support has ended, the patch will not arrive, and people should avoid sensitive data on such devices or get a new one.s

App store updates alone do not protect the device because kernel and chipset flaws require a full System Update firmware update instead, Note.com says. Even if a device automatically downloads fix data at night, the device must restart to complete the system rewrite; clearing the Update ready notification without restarting leaves the vulnerability in place. IT teams can use MDM tools to read each device’s OS version and patch level, flagging anything older than November 5, 2026, and prioritizing devices taken outside the office or accounts that handle important data. Derivative platforms such as Fire OS on Amazon Fire tablets, Fire TV, and smart TVs can also be affected when they use the same underlying code or chips.s