Critical Remote Code Execution Vulnerability in Android (CVE‑2026‑58868) Affects Versions 14‑17
What It Is — CVE‑2026‑58868 is a heap‑buffer overflow in the onOutputReceived function of FrameDecoder.cpp that enables an out‑of‑bounds write. The flaw can be triggered without any user interaction, giving an attacker the ability to execute arbitrary code on devices running Android 14 through Android 17. Google has classified the issue as Critical and released a fix in the November 2026 security patch (2026‑11‑01 or later). The advisory notes that active exploitation is already observed in the wild, making this a true zero‑click remote‑code‑execution (RCE) vector.
Affected Products — Android operating system versions 14, 15, 16, and 17 (across all OEM implementations that have not yet applied the November 2026 patch).
Why It Matters for Trust & Control Assurance — The vulnerability tests an organization’s vulnerability‑management control: timely detection, patching, and evidence collection. Verisq’s Control Mapping capability helps map this remediation to multiple frameworks in a single audit view.
Recommended Actions —
- Verify that all Android devices are on security‑patch level 2026‑11‑01 or later.
- If any devices cannot be patched immediately, isolate them from sensitive networks.
- Update your vulnerability‑management policy to ingest Google’s Android security bulletins automatically and retain patch‑compliance evidence.