Google’s Android Security Bulletin for November 2026, published on 2 November, lists CVE-2026-58868, a Critical remote code execution flaw in the Framework component. The bulletin says it needs no additional execution privileges and no user interaction. Updated AOSP versions are 14, 15, 16, 16-qpr2 and 17.
Devices at security patch level 2026-11-01 or later carry the Framework fix. Patch level 2026-11-05 or later addresses everything in the bulletin, so make that your target. NVD describes the bug as an out-of-bounds write caused by a heap buffer overflow in onOutputReceived of FrameDecoder.cpp.
Which Critical Items Sit at the 2026-11-01 Level?
The bulletin rates eight items Critical at the 2026-11-01 level. Three are remote code execution, and CVE-2026-58868 is the only one in the Framework component.
| CVE | Component | Type | Bug ID | Updated AOSP versions |
|---|---|---|---|---|
| CVE-2026-58868 | Framework | RCE | A-486464711 | 14, 15, 16, 16-qpr2, 17 |
| CVE-2026-58876 | System | RCE | A-503543341 | 14, 15, 16, 16-qpr2, 17 |
| CVE-2026-58936 | System | RCE | A-496614216 | 14, 15, 16, 16-qpr2, 17 |
| CVE-2026-55275 | System | EoP | A-522376559 | 16, 16-qpr2, 17 |
| CVE-2026-55283 | System | EoP | A-522375782 | 16, 16-qpr2, 17 |
| CVE-2026-58984 | System | EoP | A-514731794 | 15, 16, 16-qpr2, 17 |
| CVE-2026-58814 | System | DoS | A-517378147 | 14, 15, 16, 16-qpr2, 17 |
| CVE-2026-58882 | System | DoS | A-517376969 | 14, 15, 16, 16-qpr2, 17 |
The 2026-11-05 level adds Critical kernel items in Bluetooth, pKVM and HID, plus Critical modem items that MediaTek lists and one Critical Qualcomm closed-source item. The bulletin says its severity ratings assume platform and service mitigations are off or bypassed.
What Do NVD, CISA and the KEV Catalog Say?
NVD lists CVE-2026-58868 as Awaiting Analysis and carries no CVSS 3.1 or 4.0 score for it as of 4 November 2026. CISA’s SSVC entry, timestamped 2 November, lists exploitation as none, automatable as yes and technical impact as total. The flaw is not in the CISA Known Exploited Vulnerabilities catalog as of its 4 November release.
NVD shows a secondary CVSS 3.1 score of 9.8 for CVE-2026-58876 and CVE-2026-58936, the two other remote code execution items. The CVE text for CVE-2026-58868 names the vulnerable file but not the delivery route, so the record does not say which channel reaches it.
How Do You Reach the Fixed Patch Level?
- Check each device under Settings, About phone, then Android version and Android security update. The path varies by maker. Look for 2026-11-01 at minimum and 2026-11-05 as the target.
- In your mobile device manager, add a compliance rule on patch level. Flag anything below 2026-11-01 and limit its access to corporate data until it updates.
- Install pending Google Play system updates. The bulletin lists CVE-2026-58876 among the Mainline components, and devices on Android 10 or later may receive such updates.
- Read your maker’s own bulletin. The bulletin says device and chipset makers such as Google, Huawei, LGE, Motorola, Nokia and Samsung may publish details for their own products. Those details do not set the patch level.
- Plan for devices whose maker ships no update for Android 14 to 17. Replace them or keep them away from sensitive systems.
Steps 1 to 3 and 5 are our advice. The bulletin and the CVE record carry fixes, not indicators of compromise, so the patch level is your control. The bulletin lists Android 14 and later for this flaw, and the record does not state whether older versions are affected, so treat those as unpatched by this bulletin.
Google says it notifies Android partners of all issues at least a month before publishing, and AOSP source patches follow within 48 hours. Related reading: our Android kernel zero-day post, the remote code execution glossary entry and the patch management entry.