Patch Forecast
Amber warning
Patch this week.

CVE-2026-58868

In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap…

Risk score
66/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.2%
Published
2 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
A heap buffer overflow in FrameDecoder.cpp's onOutputReceived function allows a possible out-of-bounds write, potentially leading to remote code execution without user interaction.
Affected
{'products': [], 'packages': [], 'versions': []}
Fix
Check the linked advisory for details on the fix.
Exploitation
No known exploitation

Story map

Story map: CVE-2026-58868THE FLAWSTHE FIXCVE-2026-58868In onOutputReceived ofFrameDecoder.cpp, there is apossible out-of-bounds write…CVSS 9.8 · EPSS 0%FixCheck the linked advisory fordetails on the fix.Who is exposed{'products': [], 'packages': [],'versions': []}AMBER · PATCH THIS WEEKCVE-2026-58868A heap buffer overflow inFrameDecoder.cpp'sonOutputReceived functionallows a possible out-of-boundswrite, potentially leading toremote code execution withoutuser interaction.Where it standsNo known exploitation2 outlets covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.3 Nov · SecurityWeekAndroid’s November 2026 Updates Patch Over 200Vulnerabilities4 Nov · The Hacker NewsGoogle Issues Patches for Critical Android FlawThat Could Allow RCE Without User InteractionCONNECTS TOSame weaknessOut-of-bounds write (CWE-787)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

CVE-2026-58868: Amber, patch this week. A heap buffer overflow in FrameDecoder.cpp's onOutputReceived function allows a possible out-of-bounds write, potentially leading to remote code execution without user interaction.

The flaws

  • CVE-2026-58868: In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap… (CVSS 9.8 · EPSS 0%)

The fix

Fix: Check the linked advisory for details on the fix.

Who is exposed: {'products': [], 'packages': [], 'versions': []}

Where it stands

  • No known exploitation
  • 2 outlets covering it

How it unfolded

  1. 3 Nov, SecurityWeek (press): Android’s November 2026 Updates Patch Over 200 Vulnerabilities
  2. 4 Nov, The Hacker News (press): Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction

Connects to

In the news

TL;DR

Critical Android vulnerability (CVE-2026-58868) allows RCE without user interaction, patched in November 2026 updates.

  • Google patches over 200 vulnerabilities, including 2 dozen critical issues.
  • CVE-2026-58868 is a critical security vulnerability in the Framework component.
  • Patches arrive in two parts, first as 2026-11-01 security patch level, and second as 2026-11-05 security patch level.

AI summary of 2 articles.

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in

References

Original description

In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Last activity 2 Nov 2026. Patch Forecast updates every hour.