Out of bounds read in Android ShimConverter
A missing bounds check in isValid of ShimConverter.cpp allows out of bounds read. This leads to local information disclosure without additional privileges or user interaction needed. Affects Android.
What to do: apply Google's update for CVE-2026-58988
| Product | Affected |
|---|---|
| Google Android | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
The November 2026 Android security update addresses more than 200 vulnerabilities, including critical remote code execution flaws that require no user interaction.
Today 991 readers · 1.3K views · 262 reads · all time 173K views