CVE-2026-58848

CVE-2026-58848 is a race condition (CWE-362) in alloc.c on Android that can allow unauthorized read and write access to memory due to improperly synchronized concurrent operations. It is triggered by local code running on the device with no additional execution privileges required and no user interaction needed. An attacker who already has low-privileged code execution on an affected device can escalate privileges, gaining high-confidentiality, integrity, and availability impact (CVSS 3.1 score of 7.0, high). Any Android device running an affected build is exposed; the flaw is addressed in the September 2026 Android security update. There is currently no known exploitation, no public proof-of-concept, and a low predicted exploitation probability (EPSS ~0.1%).

What to do: Apply the September 2026 Android security update (or your device OEM's equivalent rollout) as soon as it is available, and verify the device's installed security patch level reflects that update. Because exploitation requires only local low-privileged code execution with no user interaction, prioritize devices that regularly run untrusted apps or multiple users; no specific workaround is known for this race condition. No public exploit or in-the-wild exploitation is currently reported, but monitor OEM advisories for component-specific affected-version details.