Android November 2026 updates patch over 200 vulnerabilities
Includes critical RCE in Framework; patches cover Android, XR and Wear OS.
80
Vulnerability1 · 1 read
CVE-2026-58868
Heap buffer overflow in Android FrameDecoder allowing RCE
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Heap buffer overflow in Android's FrameDecoder.cpp onOutputReceived allows remote code execution. No user interaction or privileges are needed to trigger it. This affects Android devices and is addressed in the November 2026 security updates.
What to do: Apply Android's November 2026 security updates.
| Product | Affected |
|---|---|
| Android | — |
Estimated exposure
largehundreds of millions of devices — Android global user base and update distribution in November 2026 release
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.