Google Android: Memory corruption in Framework allows local privilege escalation
Summary
Google Android 14 to 17 contains a memory corruption flaw caused by type confusion in the Framework component (CVE-2026-58854). An attacker with low privileges on the device, for example through a malicious or compromised app, can escalate privileges locally without user interaction. The CVSS 3.1 base score is 7.8 (High). Remote exploitation over the network is not described.
Affected
- Android 14
- Android 15
- Android 16
- Android 16-qpr2
- Android 17
Fixed in
- Security patch level 2026-10-01 or later, as listed in the Android Security Bulletin October 2026
- Samsung: October 2026 release includes the fix (exact build per model unknown)
- Other OEMs and carriers: Unknown.
Workaround
Unknown.
Exploitation
- No known exploitation in the wild at the time of research.
- No public proof of concept found.
- CISA KEV status not verified directly.
Our recommendation
- Check that managed devices report security patch level 2026-10-01 or later.
- Track the OEM and carrier rollout dates for your device models and install updates promptly.
- Prioritise unmanaged or BYOD devices with outdated patch levels, as they hold business data.
- Where devices cannot be patched, restrict app installation to trusted sources, keep Google Play Protect enabled and replace devices that no longer receive updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin October 2026 source.android.com
- Samsung October 2026 security patch release notes www.sammyfans.com
- TechRepublic: Samsung October 2026 security update www.techrepublic.com
- Hexnode: Android October 2026 security update www.hexnode.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:27.
Original description (NVD)
In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.