CVE-2026-58820

CVE-2026-58820 is a memory safety vulnerability in the Android operating system in which integer overflow conditions in multiple code locations corrupt memory, classified as a heap-based buffer overflow (CWE-122). Triggering it requires only low-level local access, as the flaw can be exploited with no additional execution privileges, meaning an app or process already running on the device can potentially abuse it. Successful exploitation results in local escalation of privilege with high impact on confidentiality, integrity, and availability on the device; no remote or unauthenticated attack path is indicated by the CVSS vector. The available data does not specify which Android versions or components are affected, but the flaw was addressed in Google's September 2026 Android Security Update, so any device not yet running that patch level is plausibly exposed. There is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and EPSS assigns only a 0.1% probability of exploitation within the next 30 days.

What to do: Install the September 2026 Android Security Update via OTA as soon as your device or carrier offers it, and confirm the security patch level in device settings shows September 2026 or later; devices past their update window should be checked against the manufacturer's support pages for a vendor patch incorporating this fix. Since exploitation requires local access, avoid installing apps from untrusted sources until the device is patched.