CVE-2026-58956: High severity Google Android vulnerability

Q: What level of access does an attacker need to exploit this issue?

Exploitation requires local access, but no privileges or user interaction are required. The stated impact is local escalation of privilege.

Q: What security property can be bypassed?

The flaw may allow signature verification to be bypassed because of a logic error in modpowF4 in avb_rsa.c. Successful exploitation can affect confidentiality, integrity, and availability.

Q: Which component should defenders investigate?

Investigate Android builds that include the android/platform/external/avb component, particularly the AVB RSA signature-verification code in avb_rsa.c.

Published Nov 1, 2026

Updated

In modpowF4 of avbrsa.c, there is a possible signature verification bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

7 affected componentsFixes available

android/platform/external/avb>=17-qpr2-next:0<17-qpr2-next:2026-11-01

17-qpr2-next:2026-11-01

android/platform/external/avb>=15:0<15:2026-11-01

15:2026-11-01

android/platform/external/avb>=16:0<16:2026-11-01

16:2026-11-01

android/platform/external/avb>=16-qpr2:0<16-qpr2:2026-11-01

16-qpr2:2026-11-01

android/platform/external/avb>=17:0<17:2026-11-01

17:2026-11-01

android/platform/external/avb>=14:0<14:2026-11-01

14:2026-11-01

Google Android

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade android/platform/external/avb to a version that resolves this vulnerability.
Fixed in 17-qpr2-next:2026-11-01
Upgrade
Upgrade android/platform/external/avb to a version that resolves this vulnerability.
Fixed in 15:2026-11-01
Upgrade
Upgrade android/platform/external/avb to a version that resolves this vulnerability.
Fixed in 16:2026-11-01
Upgrade
Upgrade android/platform/external/avb to a version that resolves this vulnerability.
Fixed in 16-qpr2:2026-11-01
Upgrade
Upgrade android/platform/external/avb to a version that resolves this vulnerability.
Fixed in 17:2026-11-01
Upgrade
Upgrade android/platform/external/avb to a version that resolves this vulnerability.
Fixed in 14:2026-11-01

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Nov 2, 2026

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Exploitation requires local access, but no privileges or user interaction are required. The stated impact is local escalation of privilege.

What security property can be bypassed?

The flaw may allow signature verification to be bypassed because of a logic error in modpowF4 in avb_rsa.c. Successful exploitation can affect confidentiality, integrity, and availability.

Which component should defenders investigate?

Investigate Android builds that include the android/platform/external/avb component, particularly the AVB RSA signature-verification code in avb_rsa.c.

CVE-2026-58956: High severity Google Android vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What security property can be bypassed?

Which component should defenders investigate?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What security property can be bypassed?

Which component should defenders investigate?