Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Android media framework may let attackers run code

CVE-2026-58857 · published 4 days ago
Summary

The decryption component in Android's media framework can free memory too early during a race condition, allowing a remote attacker to run their own code without needing any special privileges. No user interaction is required for the attack. Apply the latest security updates from Google for the affected Android platform to protect your devices.

What to do
  • Update google platform/frameworks/av to version 17-qpr2-next:2026-11-01.
  • Update google platform/frameworks/av to version 15:2026-11-01.
  • Update google platform/frameworks/av to version 16:2026-11-01.
  • Update google platform/frameworks/av to version 16-qpr2:2026-11-01.
  • Update google platform/frameworks/av to version 17:2026-11-01.
  • Update google platform/frameworks/av to version 14:2026-11-01.
Affected software
Ecosystem VendorProductAffected versions
– google android 17
Android google platform/frameworks/av >= 17-qpr2-next:0, < 17-qpr2-next:2026-11-01
>= 15:0, < 15:2026-11-01
>= 16:0, < 16:2026-11-01
>= 16-qpr2:0, < 16-qpr2:2026-11-01
>= 17:0, < 17:2026-11-01
>= 14:0, < 14:2026-11-01
Fix: upgrade to 17-qpr2-next:2026-11-01
Original advisory text
In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interactio...
In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Exploitation
<1% chance of attack within 30 days
Timeline
Published1 Nov 2026
Updated4 Nov 2026
First seen2 Nov 2026
Sources
ASB-A-503553199 · OSV
CVE-2026-58857 · NVD
CVE-2026-58857 · MITRE
Track software like this
Free during beta