CVE-2026-58821: SQL Injection

Q: What access and interaction are required to exploit this issue?

Exploitation is local and requires no additional execution privileges or user interaction. The supplied vector indicates local access rather than network access.

Q: Which deployments can be identified for triage from the available information?

The affected software listing identifies the MediaProvider component in Google Android, at android/platform/packages/providers/mediaprovider. No affected Android versions or build identifiers are provided, so version-level exposure cannot be determined from this information alone.

Published Nov 1, 2026

Updated

In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

5 affected componentsFixes available

android/platform/packages/providers/mediaprovider>=17-qpr2-next:0<17-qpr2-next:2026-11-01

17-qpr2-next:2026-11-01

android/platform/packages/providers/mediaprovider>=16:0<16:2026-11-01

16:2026-11-01

android/platform/packages/providers/mediaprovider>=16-qpr2:0<16-qpr2:2026-11-01

16-qpr2:2026-11-01

android/platform/packages/providers/mediaprovider>=17:0<17:2026-11-01

17:2026-11-01

Google Android

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Nov 2, 2026

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

CVE Published

via MITRE·07:53 PM

Data Sourced

via MITRE·07:53 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

Description

Frequently Asked Questions

What access and interaction are required to exploit this issue?

Exploitation is local and requires no additional execution privileges or user interaction. The supplied vector indicates local access rather than network access.

Which deployments can be identified for triage from the available information?

The affected software listing identifies the MediaProvider component in Google Android, at android/platform/packages/providers/mediaprovider. No affected Android versions or build identifiers are provided, so version-level exposure cannot be determined from this information alone.

CVE-2026-58821: SQL Injection

Affected Software

Event History

Frequently Asked Questions

What access and interaction are required to exploit this issue?

Which deployments can be identified for triage from the available information?

Company

Resources

Contact

Frequently Asked Questions

What access and interaction are required to exploit this issue?

Which deployments can be identified for triage from the available information?