Loading vulnerability…
Zero-click remote code execution in Android Framework FrameDecoder
CVE-2026-58868 is a critical heap-based buffer overflow in the onOutputReceived function of Android Framework's FrameDecoder implementation. The flaw can cause an out-of-bounds write and potentially allow remote code execution without additional execution privileges or user interaction. Affected releases are Android 14, 15, 16, 16 QPR2, and 17. The precise remote delivery mechanism and execution context are not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could allow an attacker to execute arbitrary code remotely on an affected device without user interaction. The resulting access depends on the privileges and security boundaries of the affected process; execution as system_server, root access, and unrestricted device compromise are not established.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is established. Built-in Android security protections may limit exploitation but are not a substitute for installing the security update.
Patch, then assume compromise.
Install the manufacturer-provided Android security update that brings the device to security patch level 2026-11-01 or later. Verify the installed Android security patch date rather than relying on the Android version or Google Play system update status alone. Security patch level 2026-11-05 or later additionally includes all applicable fixes from both November patch groups. Update availability depends on the device manufacturer and carrier.
No public exploits tracked yet. Mallory keeps watching.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.