Google Patches CVE-2026-58868 Heap Overflow in FrameDecoder Allowing Remote Code Execution on Android 14-17

The vulnerability is a heap buffer overflow triggered in media decoding paths. Google's Critical rating assumes sandbox and SELinux protections can be bypassed, consistent with prior media framework flaws like those in libstagefright. The bulletin provides no attack vector details and lists no active exploitation as of November 4, while CISA's KEV catalog shows no entry through its November 3 update.

Procurement and patch deployment records reveal the real exposure window. Android security patch level 2026-11-01 covers the flaw for Framework and runtime components, yet OEM and carrier rollout schedules create staggered coverage. Devices on Android 12 and 13 retain the vulnerable code path without listed fixes, matching patterns seen in earlier deferred kernel and modem updates.

A second Critical flaw, CVE-2026-58882 in decodeWapPdu for WAP Push SMS, enables remote denial-of-service that crashes the telephony process and blocks emergency calls. Researcher Mark B's October 29 write-up on the same function documents reliable crashes from a single malformed message, with a public proof-of-concept. The bulletin does not confirm overlap.

Unpatched devices face elevated risk from supply-chain lag rather than zero-day novelty. Google Play system updates address some Critical issues but exclude CVE-2026-58868, forcing reliance on full security patch levels. Next steps hinge on OEM contract compliance timelines and independent verification of exploit attempts against the decoder.