Google patches critical Android RCE flaws allowing remote code execution
November 2026 Android Security Bulletin addresses critical RCE vulnerabilities in Android 14-17 without user interaction.
90
Vulnerability1 · 1 read
CVE-2026-58936
Use-after-free RCE in Android PNG decoder
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free in png_set_tRNS of pngset.c allows remote code execution in Android's PNG decoder. Attackers trigger it remotely by sending a crafted PNG file with no user interaction or privileges required. This affects all unpatched Android devices.
What to do: Upgrade to the latest Android version. No workaround available.
| Product | Affected |
|---|---|
| Google Android | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
In the news
2 storiesGoogle Patches Over 200 Android Vulnerabilities Including Critical Zero-Click RCE Flaws
The November 2026 Android security update addresses more than 200 vulnerabilities, including critical remote code execution flaws that require no user interaction.
90