CVE-2026-58854

HighCVSS 7.8/10Last modified Nov 6, 2026

Description

In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

VendorProductVersions
GoogleAndroid17; 16-qpr2; 16; 15; 14

References

Timeline

Published
Oct 5, 2026
Last modified
Nov 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-588563.3In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. ThCVE-2026-588578.1In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with nCVE-2026-588597.8In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege wiCVE-2026-58865.3Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive infoCVE-2026-588657.5In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to CVE-2026-588668.4In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing pCVE-2026-588678.4In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to locaCVE-2026-588689.8In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote coCVE-2026-58874.3Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypaCVE-2026-588704.0In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This couldCVE-2026-588718.4In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to loCVE-2026-588738.4In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lea
CVE-2026-58854: High severity, CVSS 7.8 | Vulnix