Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-58924

Google Android: out-of-bounds read can lead to information disclosure

Risk score
51/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.1%
Published
2 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
The vulnerability is a heap out-of-bounds read in the EVS HAL's getStreamList() method. An attacker can craft a CameraDesc.metadata byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to …
Affected
Google Android
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Google AndroidTHE FLAWSTHE FIXCVE-2026-58924Out-of-bounds read can lead toinformation disclosureCVSS 7.5 · EPSS 0%CVE-2026-58835Heap buffer overflow can leadto remote code executionCVSS 8.8 · EPSS 0%CVE-2026-55280In multiple locations, there is apossible out-of-bounds writedue to uninitialized dataCVSS 8.8 · EPSS 0%CVE-2026-45524Missing authorisationCVSS 8.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedGoogle AndroidYELLOW · PLAN IT INGoogle AndroidIn cfg2prop of btif_storage.cc,there is a possibleout-of-bounds write due to aheap buffer overflow. This couldlead to remote code executionwith no additional executionprivileges needed. User…Where it standsNo known exploitationCONNECTS TOSame weaknessOut-of-bounds read (CWE-125)399 other warnings in 30 days →Same productEarlier Google Android warnings41 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Google Android: Yellow, plan it in. In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

The flaws

  • CVE-2026-58924: Out-of-bounds read can lead to information disclosure (CVSS 7.5 · EPSS 0%)
  • CVE-2026-58835: Heap buffer overflow can lead to remote code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-55280: In multiple locations, there is a possible out-of-bounds write due to uninitialized data (CVSS 8.8 · EPSS 0%)
  • CVE-2026-45524: Missing authorisation (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Google Android

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles.

Last activity 2 Nov 2026. Patch Forecast updates every hour.