Android flaw could let attackers run code without interaction

CVE-2026-58868 is a critical Android vulnerability disclosed in Security Affairs, affecting Android 14 through 17. The flaw arises from a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp, enabling an out-of-bounds write that could let a remote attacker execute arbitrary code on a vulnerable device. The exploit requires no user interaction or extra execution privileges, making it a potential zero-click attack.

The article quotes the advisory as noting a possible out-of-bounds write due to the heap overflow, and describes remote code execution without user interaction as a key risk.

Google has patched the issue in the November 2026 Android security bulletin, with devices receiving the fix via security patch level 2026-11-01 or later depending on OEMs and carriers. The bulletin also lists other critical flaws in various components, including system, framework, kernel, and modem code across Google, MediaTek and Qualcomm.

Notably, CVE-2026-58882 (SMS of Death) is cited as a separate critical issue in the bulletin, which could allow remote disabling of a phone via a crafted SMS, the article noting that exploitation reportedly requires no user interaction and can crash telephony components.

The report also references a technical analysis by security researcher Mark B, describing how a malformed WAP Push message can crash com.android.phone and potentially place the device in a crash loop, though it cautions that the CVE linkage to 58882 is not definitively confirmed by Google.