CVE-2026-58868 affects Android 14 through 17, Google said in its November security bulletin — and the company says a security patch level dated 2026-11-01 or later is required to remove the vulnerability from affected phones.
CVE-2026-58868: out‑of‑bounds write in FrameDecoder.cpp
Google describes CVE-2026-58868 as a possible out‑of‑bounds write caused by a heap buffer overflow in the onOutputReceived function of the file FrameDecoder.cpp. The bulletin and the CVE record do not describe how an attacker would reach that code. Google rated the flaw Critical on the assumption that "the protections built into Android and Google's services are turned off or bypassed."
Google's advisory lists Android 14 through 17 as affected; older versions such as Android 12 and 13 are not listed, and Google's records do not state whether those versions contain the same issue. As of November 4, the bulletin did not report any attacks exploiting the flaw, and the issue was not listed in the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalog as of its November 3 update.
How to check your phone for the 2026-11-01 and 2026-11-05 patches
Google's help page gives a simple check for whether a phone has the fixes:
- Open the Settings app.
- Tap About phone, or About tablet, then Android version.
- Find the dates for the Android security update and the Google Play system update.
Google states that the Android security update date is the phone's security patch level. A date of 2026-11-01 or later covers CVE-2026-58868 and the other fixes in the Framework, System, and Android runtime components. A date of 2026-11-05 or later covers every flaw in the November bulletin, including kernel fixes and fixes from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.
Google sets two patch dates so phone makers can ship a common set of fixes sooner; it encourages vendors to include every fix in the bulletin. The bulletin gives no workaround for phones that cannot install the update yet.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCVE-2026-58882 and the "SMS of Death" WAP Push crash
Another Critical item in the bulletin, CVE-2026-58882, is a remote denial‑of‑service flaw in decodeWapPdu, a function in Android's WAP Push handling code for messages delivered via SMS. The CVE record says the flaw could allow a remote denial‑of‑service attack with no user interaction.
On October 29, a researcher who publishes as Mark B posted a write‑up titled "SMS of Death" about a bug in the same function. In that write‑up a malformed WAP Push message crashes com.android.phone and ends any active call, including emergency calls; the crash occurred reliably in tests on several phone models. The attacker needs only the target's phone number; the message never appears in the inbox, and phones retry the message on startup so they can continue to crash until the message is removed. The bulletin and the CVE record do not say whether CVE-2026-58882 is the same bug described by Mark B. The researcher also published a proof‑of‑concept app and noted that phones running Android 12 and 13 run the same code but, in his view, do not receive the fix that newer versions do.
Other Critical flaws: kernel, modem, Qualcomm, and System RCEs
Google's November bulletin lists 216 vulnerabilities in total, 23 of them rated Critical. Two additional Critical remote code execution flaws are CVE-2026-58876 and CVE-2026-58936, both in Android's System component. Six Critical flaws are in the kernel, two of them in Bluetooth code; Google flags the most severe kernel flaw as potentially allowing a remote attacker to gain elevated privileges without user interaction.
The 2026-11-05 patch level also includes Critical fixes for MediaTek modem code and a closed‑source Qualcomm component. In its advisory, MediaTek describes its Critical modem flaws as out‑of‑bounds writes and says it is not aware of any active exploitation of those issues.
What this means for technologists, phone makers and carriers, and end users
- Technologists and security teams: prioritize devices showing an Android security update date of 2026-11-01 or later for immediate mitigation of CVE-2026-58868, and aim for 2026-11-05 or later to cover kernel and vendor component fixes. Note that Google distinguishes the Android security patch level from Google Play system updates; CVE-2026-58868 is not delivered via this month's Google Play system update list, so rely on the Android security update date for this specific fix.
- Phone makers and carriers: deliver the 2026-11-01 and 2026-11-05 patch sets on your published schedules; Google explicitly allows vendors to ship on their own timelines and encourages inclusion of every bulletin fix in vendor images.
- End users: check the Android security update date in Settings and install updates when vendors make them available; there is no Google‑published workaround for devices that cannot yet install the patched firmware.
Google's bulletin describes a set of vulnerabilities that range from potential remote code execution to a WAP Push message that can crash phone calling services. With fixes available in the 2026-11-01 and 2026-11-05 patch levels and no reported exploitation of CVE-2026-58868 as of November 4, the practical exposure will now depend on how quickly vendors and carriers push those patches to devices.
