CVE-2026-58984
HighCVSS 8.4Summary
In multiple locations, there is memory corruption due to a use-after-free. This could lead to local privilege escalation without additional execution privileges and without user interaction.
Risk Assessment
A local attacker could exploit the vulnerability to execute arbitrary code or escalate privileges. This may lead to full system compromise.
Recommendation
Update the software to a version containing the fix. Deploy memory corruption detection mechanisms such as ASan in test environments.
Other vulnerabilities in Android
See all- CVE-2026-59028High
In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-59022Unknown
In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2026-59021Unknown
In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed.
- CVE-2026-59020Unknown
In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed.
- CVE-2026-59016Unknown
In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-59015Unknown
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2026-59014Unknown
In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-59012Unknown
In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2026-59011Unknown
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2026-59010Unknown
In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.
Original NVD description (English source)
In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS