Google Patches Zero-Click RCE Flaw CVE-2026-58868 in Android November Security Update

Google has issued its November Google Android security bulletin, addressing 216 total vulnerabilities across the operating system and ecosystem vendor components. Among the 23 vulnerabilities rated Critical, the primary focus for enterprise security teams is CVE-2026-58868, a zero-click remote code execution (RCE) Android vulnerability affecting Android versions 14 through 17. The flaw resides in media parsing code within FrameDecoder.cpp and allows an unauthenticated remote attacker to execute arbitrary code without requiring any victim interaction.

Technical Breakdown of CVE-2026-58868

The vulnerability is rooted in an out-of-bounds write caused by a heap buffer overflow inside the onOutputReceived function of FrameDecoder.cpp. When processing incoming media frames or streams, the function fails to validate boundary limits before copying data into allocated heap memory. If an attacker delivers a specially crafted media payload—whether ingested automatically through messaging services, web components, or background media indices—the resulting out-of-bounds write corrupts heap memory structure, paving the way for remote code execution.

Google assigns the issue a Critical rating under the working baseline that standard system protections and sandbox isolation mechanisms are bypassed or disabled. The vulnerability directly impacts Android 14, 15, 16, and 17. Older versions, such as Android 12 and 13, are not listed as affected in Google’s official documentation, though vendor releases do not confirm whether those codebases contain legacy variants of the flaw.

From an exploit probability standpoint, CVE-2026-58868 currently carries an Exploit Prediction Scoring System (EPSS) probability of 0.21%, placing it in the 11.3th percentile of all scored vulnerabilities. This low initial metric is standard for newly disclosed vulnerabilities where weaponized exploit chains have not yet populated public repositories or threat feeds. However, media processing buffer overflows historically attract swift target development; once patch diffing highlights the memory corruption logic in FrameDecoder.cpp, functional zero-click exploits often emerge rapidly.

The “SMS of Death” WAP Push Vulnerability (CVE-2026-58882)

The November advisory highlights a second Critical flaw designated CVE-2026-58882, which provides an unauthenticated remote denial-of-service (DoS) attack vector requiring zero user interaction. This vulnerability exists within decodeWapPdu, a function handling Wireless Application Protocol (WAP) Push messages delivered over cellular SMS networks.

An attacker requires only the target victim’s phone number to send a malformed WAP Push message. Upon receipt, the underlying telephony subsystem attempts to process the message silently without creating an inbox entry or alerting the user. The malformed payload triggers an immediate crash of com.android.phone, terminating any active voice calls—including emergency calls. Furthermore, because Android stores pending WAP Push messages to process them across reboots, the affected device can re-trigger the decodeWapPdu crash upon every system startup, locking the phone into a permanent bootloop or telephony crash loop.

Independent research released under the header “SMS of Death” demonstrates that devices running Android 12 and 13 contain the vulnerable decodeWapPdu function. However, Google is not backporting updates for those legacy Android versions in this bulletin, leaving unmanaged older hardware susceptible to silent SMS denial-of-service attacks.

Kernel, Bluetooth, and Hardware Component Risks

Beyond the primary media framework and telephony bugs, the November patch set addresses significant exposure across low-level kernel drivers and binary vendor blobs:

• System Component RCE: CVE-2026-58876 and CVE-2026-58936 introduce two additional Critical remote code execution vulnerabilities within the Android System component. CVE-2026-58876 is addressable through Google Play system updates on devices running Android 10 or later.
• Kernel & Bluetooth Subsystems: Six Critical vulnerabilities are patched in the Linux kernel layer, including two in Bluetooth drivers. The most severe kernel vulnerability allows a remote attacker to gain elevated privileges without user interaction.
• Proprietary Vendor Modules: The comprehensive 2026-11-05 security patch level delivers patches for out-of-bounds write flaws in MediaTek cellular modem firmware, closed-source Qualcomm hardware components, and hardware integration modules from Arm, Imagination Technologies, and Unisoc.

Enterprise Patch Deployment and Mitigation Guidance

Google splits the November release into two distinct patch levels to assist device original equipment manufacturers (OEMs) and carriers in staging updates:

1. Security Patch Level 2026-11-01: Addresses core platform risks, including CVE-2026-58868 (FrameDecoder.cpp), System, and Android Runtime components.
2. Security Patch Level 2026-11-05: Represents the complete bulletin fix set, adding protection for kernel driver vulnerabilities, MediaTek modem issues, and Qualcomm binary modules.

Enterprise security administrators should implement the following control steps:

• Update Enforcement: Enforce Mobile Device Management (MDM) compliance policies requiring Android devices accessing internal resources to update to security patch level 2026-11-01 or later for CVE-2026-58868 mitigation, and 2026-11-05 for complete hardware-layer coverage.
• Modular Component Updates: Verify that Android devices have Google Play system updates enabled to automatically receive fix packages for modular vulnerabilities like CVE-2026-58876.
• Legacy System Management: Because devices stuck on Android 12 or 13 do not receive vendor security patches for the decodeWapPdu crash (CVE-2026-58882), evaluate replacing unmanaged legacy hardware or applying carrier-level SMS filtering for high-risk positions.