CVE-2026-58874

CVE-2026-58874 is a local escalation of privilege flaw in the Android telephony/SMS framework, specifically in multiple functions of SmsController.java, caused by a missing permission check (CWE-269). It is triggered locally by code already running on the device, with no user interaction required, when those SMS controller functions are invoked without the proper permission check. An attacker with local access gains elevated privileges with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/PR:L/UI:N). All Android devices running framework versions containing the vulnerable SmsController code are affected; the precise version range is not specified in the available data. There is currently no evidence of exploitation: no known public proof-of-concept, not listed in CISA KEV, and a low EPSS of 0.1%.

What to do: Apply the Android security patch level from the Android Security Bulletin that includes CVE-2026-58874 as soon as OEM updates reach your devices; check device Settings > Security & privacy > security patch level and managed-fleet compliance reports. Because the flaw is in the platform framework, there are no documented workarounds other than installing the patch.