Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks

DNG SDK versions 1.7.1 2471 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-28618 is a heap buffer overflow in the dec_frm_prepare function of oapv.c, part of the OpenAPV (APV) video decoder shipped in Android, which allows an out-of-bounds write while preparing frame buffers for decoding. The flaw is triggered by processing maliciously crafted APV video bitstream data, and per the Android bulletin no user interaction and no additional execution privileges are required to exploit it. A successful attack yields remote code execution in the context of the affected media component. Affected parties are Android devices whose builds include the OpenAPV decoder (and any products embedding the liboapv code); the fix ships in the September 2026 Android security update, though specific affected version ranges are not provided in the source data. There is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns a low 0.2% probability of exploitation within 30 days, indicating no known exploitation at this time.

Do: Apply the September 2026 Android security update (or later) as soon as your device or fleet's OEM delivers it, and verify the installed security patch level afterward. As an interim mitigation, avoid opening or decoding untrusted APV-encoded video content from unverified sources. Embedded-product maintainers who ship the OpenAPV liboapv code should check for and integrate the upstream fix.

CVE-2026-28666 is a flaw in LocalImageResolver.java in the Android platform's image-handling code, where a DNG (Digital Negative) image rendering check can be bypassed. The Android security team classifies the issue as a remote persistent denial of service, but notes it could also lead to remote escalation of privilege, requiring no additional execution privileges and no user interaction. An attacker could trigger the flaw by getting a crafted DNG image processed by an affected device, degrading the device persistently or, per the bulletin, gaining elevated code execution. The flaw affects the Android platform component (assigned by [email protected]), so any Android device shipping the vulnerable image-resolution code is potentially exposed, pending OEM patches. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

Do: Apply the September 2026 Android security update (or later) as delivered by your device OEM or carrier, and confirm the fix by checking the device's Android security patch level. Until patched, treat DNG images from untrusted sources (messaging, email, web, cloud sync) with caution, and prioritize updating devices whose apps or workflows automatically process remote images. Since no exploit is public, routine patch cadence is reasonable for most fleets, with faster action for exposed, image-handling-heavy deployments.

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED checks In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket state is LLCP_CLOSED, the code correctly calls release_sock() and nfc_llcp_sock_put() but fails to return. Execution falls through to the remainder of the function, which calls release_sock() and nfc_llcp_sock_put() again. This results in a double release_sock() and a refcount underflow via double nfc_llcp_sock_put(), leading to a use-after-free. Add the missing return statements after the LLCP_CLOSED branches in both functions to prevent the fall-through.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.

CVE-2026-45515 is a heap buffer overflow, resulting in an out-of-bounds write, in a2dp_vendor_opus_decoder_decode_packet (a2dp_vendor_opus_decoder.cc), part of the Android Bluetooth stack's A2DP vendor Opus audio decoder. It is triggered when the device decodes a crafted or oversized Opus-encoded packet received over an A2DP Bluetooth audio connection, meaning a nearby device acting as the audio source can reach the vulnerable code with no user interaction and no additional privileges required. Successful exploitation yields local escalation of privilege, allowing an attacker to run code in the affected Bluetooth component with elevated capabilities. Android devices carrying the affected Bluetooth stack are potentially affected; Google patched the flaw in the September 2026 Android Security Update, and specific affected version ranges are not enumerated in the source data. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known, and EPSS estimates the 30-day exploitation probability at roughly 0.1%.

Do: Apply the September 2026 Android Security Update (or an OEM build containing that patch level or later) as soon as it is rolled out to your devices. Until patched, reduce exposure by avoiding A2DP audio-sink connections with untrusted nearby Bluetooth devices and disabling Bluetooth when not in use. Verify devices show a September 2026 (or later) Android security patch level in Settings.

An out-of-bounds read caused by a heap buffer overflow exists in the read_boot_region function of fsck.c on Android. It can be triggered when the system's fsck tool processes a malformed or crafted filesystem boot region, with no user interaction and no additional execution privileges required. A successful exploit could allow a local attacker to escalate privileges on the affected device. All Android devices running security patch levels prior to the September 2026 Android Security Update are potentially affected. There is no public proof of concept, the flaw is not in CISA KEV, and EPSS is low (0.1%), indicating no known exploitation to date.

Do: Apply the September 2026 Android Security Update (or a later OEM patch) and verify the device's security patch level in Settings. Given the low EPSS, absence of a public PoC, and no KEV listing, routine patch cadence is sufficient, but prioritize devices that mount untrusted or removable storage processed by fsck.

CVE-2026-49879 is an integer overflow in Android's NFC reader/writer code (rw_t3t.cc, the component that handles NFC Type 3/FeliCa tags) that results in an out-of-bounds write when the stack processes crafted tag data. An attacker can trigger it by getting the device to process malicious NFC data — most plausibly a nearby malicious NFC tag — with no user interaction and no special privileges required. Successful exploitation yields remote code execution in the context of the NFC service, though no public proof-of-concept or in-the-wild exploitation is currently known. Any Android device with NFC hardware is potentially affected, with the fix delivered through the September 2026 Android Security Update. EPSS currently estimates only a 0.2% probability of exploitation within 30 days and the flaw is not yet in CISA's KEV catalog.

Do: Apply the September 2026 Android security update as soon as it is available and confirm the patched security patch level under Settings > About phone. No public exploit exists yet, so there is no urgent emergency, but patch promptly; as an interim mitigation, users can disable NFC when not in use. Defenders should watch for PoC releases given the no-interaction RCE primitive.

CVE-2026-49882 is a heap buffer overflow in rw_mfc_handle_read_op (rw_mfc.cc), part of the Android NFC stack's handling of MIFARE Classic (MFC) tags. An attacker within NFC range can trigger the flaw by presenting a maliciously crafted MIFARE Classic tag to a device whose NFC reader processes it, with no user interaction and no privileges required. Successful exploitation can lead to remote code execution on the affected device. Android devices carrying the vulnerable NFC code are affected; the data does not specify exact version ranges, and the fix ships in the September 2026 Android security update per related reporting. There is currently no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns it a low 0.2% probability of exploitation in the next 30 days, so no exploitation is known.

Do: Apply the September 2026 Android security update (or the vendor build that includes it) as soon as it is available; check Settings > Security for the patch level rather than relying on a specific version number, which is not enumerated in the source data. As an interim mitigation, disable NFC when not needed and avoid bringing unknown NFC/MIFARE tags near unpatched devices. Monitor the Android Security Bulletin for the confirmed patched build list.

CVE-2026-49884 is an out-of-bounds write in the function rw_mfc_handle_read_op (rw_mfc.cc) in Android's NFC stack, the component that handles read operations for MIFARE Classic (MFC) tags; the bug is caused by an incorrect bounds check. It is triggered when the device's NFC component processes crafted tag data, and the description states that exploitation requires no additional execution privileges and no user interaction, consistent with hostile NFC tag data being parsed without the user doing anything. A successful exploit yields local escalation of privilege on the affected device, letting an attacker gain higher privileges than they started with. Affected products include Android devices running the impacted NFC stack — in practice the broad base of NFC-equipped Android phones — though specific affected version ranges are not specified in the available data, with the fix delivered via the Android security update cycle (related coverage ties it to the September 2026 Android Security Update). There is currently no known exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days.

Do: Install the September 2026 Android security patch (or later) as soon as your device or OEM delivers it, and confirm the NFC-related fixes are included in the build. Until patched, disable NFC or avoid tapping untrusted MIFARE Classic cards/tags on affected devices. No public PoC, no KEV listing, and ~0.1% EPSS indicate low current exploitation risk, but patch promptly because the flaw requires no user interaction to exploit.

CVE-2026-49918 is an out-of-bounds write in multiple Android functions caused by an integer overflow, likely when computing buffer sizes or offsets during memory operations. A local attacker who can already execute code in an unprivileged app context can trigger the overflow to write past buffer boundaries and escalate privileges, with no additional execution privileges and no user interaction required. Any Android device on an affected build is exposed, although the available data does not identify the specific component or version range. The flaw was addressed in the September 2026 Android security update; there is no public proof-of-concept, it is not in CISA KEV, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days.

Do: Apply the September 2026 Android security update as soon as your device OEM (Pixel, Samsung, etc.) delivers it, and verify managed fleets report the September 2026 patch level. Because exploitation requires local code execution rather than remote attack, prioritizing patching on devices that run untrusted third-party apps is a reasonable interim risk-reduction step. Watch the AOSP/OEM advisories for the component-level detail needed to scope specific version ranges.

CVE-2026-49919 is an integer overflow in tt_face_colr_blend_layer in ttcolr.c, the code that blends COLR (color font) glyph layers in the Android platform's font rendering stack. It is triggered when the system processes a crafted color font whose layer values overflow the integer arithmetic in the blending routine, and no user interaction is required for exploitation. A successful attack could lead to remote code execution within the affected component and, per the advisory, local escalation of privilege without requiring any additional execution privileges. Affected users are those running Android builds that include the vulnerable font rendering code, which Google has fixed in the September 2026 Android security update (specific version ranges were not enumerated in the available data). Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

Do: Apply the September 2026 Android security update (or your device vendor's patch incorporating it) as soon as it is distributed, and verify in Settings that the Android security patch level is September 2026 or later. Because exploitation requires no user interaction and no special privileges, patching is the primary mitigation; enterprises should track OEM rollout and monitor CISA KEV and Android bulletins for changes in exploitation status.

CVE-2026-49921 is a memory-safety vulnerability in the Android operating system in which a heap buffer overflow (CWE-122) is present in multiple locations in the affected code. It is remotely exploitable over the network with no authentication, no additional privileges, and no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). A successful attack yields remote code execution with high impact on confidentiality, integrity, and availability, reflected in the critical CVSS 3.1 base score of 9.8. Affected parties are users of Android devices covered by the September 2026 Android Security Update, though the bulletin-level data does not specify the affected component or exact version ranges. As of now there is no known exploitation in the wild, no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns only a 0.3% probability of exploitation within 30 days.

Do: Apply the September 2026 Android Security Update as soon as your device OEM delivers it, and confirm the Android security patch level now reads September 2026 or later (check Settings > About phone). Because rollout is manufacturer-dependent, prioritize managed and internet-exposed Android fleets (e.g., via MDM) for early patching and track OEM advisories for your specific models. No public PoC or configuration-based workaround is documented; memory-safety flaws cannot be mitigated by settings, so patching is the primary defense.

CVE-2026-49927 is an integer-overflow flaw (CWE-190) in the Android operating system that results in an out-of-bounds write; the description notes it exists 'in multiple locations' but the specific Android component is not identified in the available data. It is triggered by local code running on the device, such as a malicious or compromised app, and exploitation requires no user interaction and no additional execution privileges. A successful exploit gives the attacker elevated code execution, producing high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Any Android device running a build containing the vulnerable code is affected, meaning devices across the multi-billion-device Android install base that have not yet received the September 2026 Android Security Update in which the fix ships; that update's headline also covers other, separately tracked critical RCE flaws. There is no evidence of exploitation so far: the flaw is not in CISA KEV, its EPSS score is 0.1% over the next 30 days (0th percentile), and no public proof-of-concept is known.

Do: Apply the September 2026 Android Security Update or any later monthly security release and confirm the device's Android security patch level in Settings, noting that OEM rollout timing varies. Until patched, treat untrusted local code (sideloaded or third-party apps) as the main attack path, since exploiting this flaw requires an attacker to already run code on the device. No public PoC or in-the-wild exploitation is known, so no emergency response is required, but unpatched devices should be prioritized in the normal patch cycle.

CVE-2026-49932 is a heap-based buffer overflow (out-of-bounds read, CWE-122) in the parseParts function of PduParser.java, part of the Android telephony/MMS PDU-parsing stack. The flaw is triggered when a crafted or malformed PDU is parsed, and exploitation requires no user interaction and no additional execution privileges, making it reachable by a low-privileged local attacker. A successful exploit yields local escalation of privilege, with confidentiality, integrity, and availability impact scored high in the CVSS vector. All Android devices carrying the vulnerable AOSP telephony code are affected, though specific affected version ranges were not provided in the available data. There is no evidence of exploitation so far: no public proof-of-concept is known, the flaw is not in CISA's KEV catalog, EPSS puts the 30-day exploitation probability at 0.1%, and a fix shipped in the September 2026 Android Security Update.

Do: Install the September 2026 Android security patch (or the OEM/carrier build incorporating it) on all managed Android devices, and verify the reported security patch level via MDM or Settings > About phone. Since no public PoC or in-the-wild exploitation is known, near-term risk is low, but the flaw sits in always-on PDU parsing code, so prioritize patching devices handling sensitive data.

CVE-2026-55256 is an improper input validation flaw in the parsePartHeaders routine of Android, which parses message part headers; malformed content processed by this parser can trigger a persistent denial of service. It can be triggered remotely, with no attacker privileges and no user interaction required, by delivering crafted data to the affected parsing code. An attacker gains a sustained, persistent denial-of-service condition on the affected device or component; no code execution, privilege escalation, or data exposure is described. Any Android build containing the vulnerable parsing code is affected, but the available data does not specify which Android versions or ranges are impacted. There is currently no known exploitation, no public proof of concept, a low predicted exploitation probability (EPSS 0.2%, 5th percentile), and the flaw is not in the CISA KEV catalog.

Do: Apply Android security updates from Google or your device OEM as soon as they reach your devices, including the September 2026 security update cycle, and confirm the installed security patch level in device settings afterward. No workaround is specified in the available data; prioritize devices that ingest remote content automatically (e.g., email or messaging services), since exploitation needs no user interaction or privileges. Monitor the Android security bulletin and OEM advisories for the concrete patched versions once published.

CVE-2026-55273 is an improper input validation flaw (CWE-20) in the AppendCommentLine function of AnnotationProcessor.cpp in the Android platform, which Google's Android security team characterizes as a possible supply chain risk. It is exploited locally: an attacker who already has low-level code execution on a device needs no additional privileges and no user interaction to trigger the flaw. Successful exploitation yields local escalation of privilege, with high impact on confidentiality, integrity, and availability, consistent with the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N). Android devices and OEM builds that include the affected component are in scope; the flaw is addressed in the September 2026 Android Security Update. There are currently no reports of exploitation in the wild, no public proof-of-concept, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog, with EPSS estimating only a 0.1% chance of exploitation in the next 30 days.

Do: Apply the September 2026 Android security update as soon as it becomes available for your devices (check Settings > System > System update for the new patch level). OEMs, carriers, and AOSP maintainers should merge the upstream fix into their build trees, and since the flaw is flagged as a supply chain risk, rebuild or re-validate artifacts produced with the affected AnnotationProcessor component using patched tooling. No workaround is documented; given no known exploitation and very low EPSS, this can be handled in the normal patch cycle rather than as an emergency.

CVE-2026-55277 is a missing-bounds-check flaw in the checkUiccListenConfigNeeded function of RoutingManager.cpp in the Android operating system, resulting in an out-of-bounds write (CWE-120). It can be triggered remotely over a proximal/adjacent connection (CVSS attack vector 'adjacent', e.g., within radio or local-network reach) and requires no user interaction and no additional execution privileges. A successful attacker gains code execution in the affected component with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.0, High). Any Android device running a build that predates the September 2026 Android security update and containing the vulnerable code is potentially affected; the fix is delivered in the September 2026 Android Security Update. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days (2nd percentile).

Do: Install the September 2026 (or later) Android security update on affected devices, either via Settings > System > System update or through OEM/carrier rollout, and verify the patch level on managed fleets with MDM tooling. No public proof-of-concept or known exploitation exists yet, so there is no urgent workaround, but prioritize patching because the flaw allows unprivileged, no-interaction remote code execution over an adjacent network path.

CVE-2026-55285 is an out-of-bounds write (CWE-120) in the openLogicalChannel routine of multiple files in the Android OS, caused by a missing bounds check. A local attacker needs no additional execution privileges and no user interaction to trigger the flaw, which corrupts memory and enables local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/PR:L/UI:N). Any Android device carrying the affected platform code is exposed, though Google has not published affected version ranges in the available data; fixes ship in the September 2026 Android Security Bulletin. Exploitation status: no public proof-of-concept, not listed in CISA KEV, and EPSS assigns a 0.1% probability of exploitation in the next 30 days, so no confirmed in-the-wild exploitation is known. The related September 2026 bulletin headline covers broader Android fixes including RCE bugs, but this specific flaw is a local privilege escalation, not a remote one.

Do: Apply the September 2026 Android Security Bulletin as delivered by Google and OEMs (e.g., Samsung and other vendor monthly patch releases), and verify each device's Android security patch level is September 2026 or later via Settings > About phone > Android security update. Until patched, restrict untrusted local apps and device access, since exploitation requires only local code execution with no user interaction or special privileges. Monitor the Android security bulletin for published affected-version ranges, which are not yet enumerated in the available data.

CVE-2026-58820 is a memory safety vulnerability in the Android operating system in which integer overflow conditions in multiple code locations corrupt memory, classified as a heap-based buffer overflow (CWE-122). Triggering it requires only low-level local access, as the flaw can be exploited with no additional execution privileges, meaning an app or process already running on the device can potentially abuse it. Successful exploitation results in local escalation of privilege with high impact on confidentiality, integrity, and availability on the device; no remote or unauthenticated attack path is indicated by the CVSS vector. The available data does not specify which Android versions or components are affected, but the flaw was addressed in Google's September 2026 Android Security Update, so any device not yet running that patch level is plausibly exposed. There is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and EPSS assigns only a 0.1% probability of exploitation within the next 30 days.

Do: Install the September 2026 Android Security Update via OTA as soon as your device or carrier offers it, and confirm the security patch level in device settings shows September 2026 or later; devices past their update window should be checked against the manufacturer's support pages for a vendor patch incorporating this fix. Since exploitation requires local access, avoid installing apps from untrusted sources until the device is patched.

CVE-2026-58823 is a memory safety bug in stpropnci_process_std of stpropnci_std.cc, part of the NFC/NCI stack shipped in Android; the component name indicates STMicroelectronics' proprietary NCI (NFC Controller Interface) extension, and the missing bounds check allows a classic buffer overflow (CWE-120). The flaw is triggered when the NFC stack processes crafted input, and exploitation requires only the ability to execute code locally on the device — no additional privileges and no user interaction are needed. A successful attacker gains local escalation of privilege, with a high-impact outcome for confidentiality, integrity, and availability (CVSS 3.1 score 7.8, High). Affected are Android devices containing the vulnerable component, i.e., devices running security patch levels older than the September 2026 Android Security Update, which carries the fix. There is no evidence of exploitation so far: no public proof-of-concept exists, the flaw is not in CISA KEV, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days.

Do: Apply the September 2026 Android security update (the patch level issued with that bulletin or later) as soon as it reaches your devices, noting that OEM rollout timing varies and NFC-stack fixes often ship in vendor-specific updates rather than day-one OTA releases. There are no known workarounds, but limiting installation of untrusted apps reduces local attack surface. Enterprise defenders should inventory which managed devices use STMicroelectronics NFC silicon and prioritize those fleets for patching, monitoring OEM security advisories for the corresponding fix.

CVE-2026-58846 is a use-after-free in the kvm_iommu_map_sg function (iommu.c) of the KVM IOMMU code in the Android Linux kernel, caused by a missing permission check (CWE-269). A local attacker can reach the vulnerable scatter-gather mapping path and trigger the flaw without user interaction and with no additional execution privileges. Successful exploitation yields local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). Affected parties are users of Android devices running vulnerable kernel builds; Google shipped the fix in the September 2026 Android Security Update. There is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.1% probability of exploitation within 30 days, so no exploitation is currently known.

Do: Apply the September 2026 Android Security Update (or the corresponding OEM/SoC kernel patch) as it reaches your fleet, prioritizing devices where users can install and run untrusted local apps. Confirm with OEMs that the kvm_iommu_map_sg kernel fix is included in their builds, and until patched, restrict app installs from untrusted sources to reduce local-attack surface. No public PoC or in-the-wild exploitation is known, so standard monthly patch cadence is adequate.

CVE-2026-58848 is a race condition (CWE-362) in alloc.c on Android that can allow unauthorized read and write access to memory due to improperly synchronized concurrent operations. It is triggered by local code running on the device with no additional execution privileges required and no user interaction needed. An attacker who already has low-privileged code execution on an affected device can escalate privileges, gaining high-confidentiality, integrity, and availability impact (CVSS 3.1 score of 7.0, high). Any Android device running an affected build is exposed; the flaw is addressed in the September 2026 Android security update. There is currently no known exploitation, no public proof-of-concept, and a low predicted exploitation probability (EPSS ~0.1%).

Do: Apply the September 2026 Android security update (or your device OEM's equivalent rollout) as soon as it is available, and verify the device's installed security patch level reflects that update. Because exploitation requires only local low-privileged code execution with no user interaction, prioritize devices that regularly run untrusted apps or multiple users; no specific workaround is known for this race condition. No public exploit or in-the-wild exploitation is currently reported, but monitor OEM advisories for component-specific affected-version details.

CVE-2026-58941 is an out-of-bounds read/write vulnerability caused by improper input validation (CWE-20) in multiple functions of iommu.c, the IOMMU (I/O memory management) component of the Linux kernel used in Android. A local attacker can trigger the flaw by supplying improperly validated input to IOMMU-related kernel interfaces, with no user interaction and no additional privileges required. Successful exploitation lets the attacker read or write out-of-bounds kernel memory, escalating from local app-level access to kernel-level control of the device. Affected are Android devices running kernels that include the vulnerable iommu.c code prior to the September 2026 Android security update; the provided data does not specify exact version ranges. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.1%, so no exploitation is currently known.

Do: Apply the September 2026 Android security update (or later) as soon as your device OEM delivers it, and confirm the patch level in Settings under Security & privacy shows September 2026 or newer. Because exploitation requires local code execution, avoid sideloading or installing apps from untrusted sources on unpatched devices. Monitor your OEM's security bulletin for device-specific kernel patches addressing this CVE.