Android: Out-of-bounds write in host link handler allows local escalation
Summary
A missing bounds check in the HostLinkBase::chreIpiHandler function of Android's host_link.cc allows an out-of-bounds write. An attacker with local access and System execution privileges can use it to escalate privileges. No user interaction is required. The CVSS score of 6.7 was provided with the CVE data, and NVD had not yet completed its analysis.
Affected
- Android devices with the affected kernel code (the CNA record lists the Android kernel as affected; default unaffected)
- Exact affected builds per device model: Unknown.
Fixed in
- Android security patch level 2026-11-05 or later (Pixel Update Bulletin November 2026)
Workaround
- None known. No vendor mitigation is published; apply the patch.
Exploitation
- Not known to be exploited. CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- Public proof of concept: Unknown.
Our recommendation
- Install the November 2026 update (patch level 2026-11-05 or later) on all Pixel and other Android devices, ideally via mobile device management.
- Check the security patch level of each device and track the staged rollout.
- Prioritise remote code execution and critical items first, as this local issue has lower exposure.
- Monitor for public exploit reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-58781 www.cve.org
- Pixel Update Bulletin November 2026 source.android.com
- OSV PUB-A-518786047 osv.dev
- Strix CVE-2026-58781 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:24.
Original description (NVD)
In HostLinkBase::chreIpiHandler of host_link.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.