Google Patches Critical Zero-Click Android RCE Flaw CVE-2026-58868, Fixes 216 Vulnerabilities in November Bulletin
Google has released its November 2026 Android security bulletin, patching 216 vulnerabilities including 23 Critical flaws. The headline issue, CVE-2026-58868, is a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp affecting Android 14 through 17, allowing remote code execution with no user interaction and no additional privileges — a potential zero-click exploit. Google states it is aware of active exploitation related to flaws covered in this bulletin. The bulletin also addresses two other System-component RCE flaws (CVE-2026-58876, CVE-2026-58936), six Critical kernel flaws (Bluetooth, pKVM, HID), eight Critical MediaTek modem vulnerabilities, and one Critical closed-source Qualcomm component flaw (CVE-2026-25285). Separately, CVE-2026-58882, dubbed "SMS of Death," could let an attacker remotely crash or disable a phone by sending a crafted WAP Push SMS message to decodeWapPdu, potentially terminating active calls including emergency calls and triggering a crash loop.
Entenda a falha
A vulnerabilidade
CVE-2026-58868, the most severe, is a heap buffer overflow (out-of-bounds write) in the onOutputReceived function of FrameDecoder.cpp in Android. It affects Android 14 through 17. A remote attacker needs no privileges and no user interaction, so it is a potential zero-click remote code execution. It is fixed at security patch level 2026-11-01 or later. The same bulletin fixes two more System-component RCE flaws without user interaction (CVE-2026-58876, CVE-2026-58936), a Critical Qualcomm closed-source flaw (CVE-2026-25285) and eight Critical MediaTek modem flaws. MediaTek details six of them (CVE-2026-20499, CVE-2026-20545 to CVE-2026-20549) as out-of-bounds writes, fixed at patch level 2026-11-05. CVE-2026-58882, 'SMS of Death', is in decodeWapPdu and lets a crafted WAP Push SMS crash the phone.
Como funciona
For CVE-2026-58868, the advisory says data reaches onOutputReceived in FrameDecoder.cpp and the function writes outside the bounds of a heap buffer. The articles do not describe what input triggers it. For CVE-2026-58882, a WAP Push message, a kind of content delivered over the SMS infrastructure, arrives at the phone and decodeWapPdu parses it. A malformed message crashes com.android.phone, the telephony process, which can end ongoing calls including emergency calls. The message does not show up in the inbox, and Android retries processing it at every boot, so the phone falls into a crash loop.
Por que é vulnerável
CVE-2026-58868 is an out-of-bounds write caused by a heap buffer overflow. The articles say nothing more about the specific flaw in the code. MediaTek describes its modem flaws as out-of-bounds writes from missing bounds checks, integer overflow or improper input validation. For the SMS of Death, the articles only say the malformed WAP Push message is not handled safely in decodeWapPdu and is retried at each boot. They do not detail the fix.
Onde está
The articles name the onOutputReceived function in FrameDecoder.cpp (CVE-2026-58868) and the decodeWapPdu function (CVE-2026-58882), both in Android; no commit is cited.
Como foi descoberta
The articles do not say who found CVE-2026-58868. Google published it in its November 2026 Android security bulletin and says it is aware of active exploitation related to flaws in this bulletin, without saying which ones. MediaTek says it knows of no exploitation of its six modem flaws. The SMS of Death was analyzed publicly on October 29 by researcher Mark B. Google's bulletin and the CVE record do not confirm that CVE-2026-58882 is the same issue, though the vulnerable function overlaps.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 08:16.
Detalhes técnicos
CVE-2026-58868 is caused by an out-of-bounds write due to a heap buffer overflow, enabling remote code execution with no execution privileges or user interaction needed. MediaTek's own bulletin details six of the eight Critical modem flaws (CVE-2026-20499, CVE-2026-20545 through CVE-2026-20549) as out-of-bounds write issues from missing bounds checks, integer overflow, or improper input validation; MediaTek states it is not aware of active exploitation of these specific flaws. For CVE-2026-58882, researcher Mark B published analysis on October 29 showing a malformed WAP Push message can crash com.android.phone, with the device retrying the malicious message on every reboot, causing a persistent crash loop. Google's bulletin does not explicitly confirm CVE-2026-58882 is the same issue as the "SMS of Death" report, though the vulnerable function overlaps.
Remediação
Devices receive fixes via security patch level 2026-11-01 or later (patch level 2026-11-05 covers MediaTek and Qualcomm issues), rollout timing depends on device manufacturers and carriers. Users should apply the latest Android security updates as soon as they become available.
Linha do tempo
-
Google Patches Critical Zero-Click Android RCE Flaw CVE-2026-58868, Fixes 216 Vulnerabilities in November Bulletin
ler a análise desta fonte ocultar
Google has released its November 2026 Android security bulletin, patching 216 vulnerabilities including 23 Critical flaws. The headline issue, CVE-2026-58868, is a heap buffer overflow in the
onOutputReceivedfunction ofFrameDecoder.cppaffecting Android 14 through 17, allowing remote code execution with no user interaction and no additional privileges — a potential zero-click exploit. Google states it is aware of active exploitation related to flaws covered in this bulletin. The bulletin also addresses two other System-component RCE flaws (CVE-2026-58876, CVE-2026-58936), six Critical kernel flaws (Bluetooth, pKVM, HID), eight Critical MediaTek modem vulnerabilities, and one Critical closed-source Qualcomm component flaw (CVE-2026-25285). Separately, CVE-2026-58882, dubbed "SMS of Death," could let an attacker remotely crash or disable a phone by sending a crafted WAP Push SMS message todecodeWapPdu, potentially terminating active calls including emergency calls and triggering a crash loop.Technical Details
CVE-2026-58868 is caused by an out-of-bounds write due to a heap buffer overflow, enabling remote code execution with no execution privileges or user interaction needed. MediaTek's own bulletin details six of the eight Critical modem flaws (CVE-2026-20499, CVE-2026-20545 through CVE-2026-20549) as out-of-bounds write issues from missing bounds checks, integer overflow, or improper input validation; MediaTek states it is not aware of active exploitation of these specific flaws. For CVE-2026-58882, researcher Mark B published analysis on October 29 showing a malformed WAP Push message can crash
com.android.phone, with the device retrying the malicious message on every reboot, causing a persistent crash loop. Google's bulletin does not explicitly confirm CVE-2026-58882 is the same issue as the "SMS of Death" report, though the vulnerable function overlaps.Remediation
Devices receive fixes via security patch level 2026-11-01 or later (patch level 2026-11-05 covers MediaTek and Qualcomm issues), rollout timing depends on device manufacturers and carriers. Users should apply the latest Android security updates as soon as they become available.