CVE-2026-58968: Double Free

Q: What access and user involvement are required for exploitation?

The vulnerability is rated with a local attack vector and requires low attack complexity. No privileges or user interaction are required according to the supplied metrics and description.

Q: Which software components are identified as affected?

The affected software is identified as Android's external libopenapv component, in the android/platform/external/libopenapv project. Google Android is also listed.

Q: Can exposure be determined from affected-version information?

No affected version ranges or fixed versions are provided in the supplied data. The listed references may contain the version-specific remediation details.

Published Nov 1, 2026

Updated

In oapvdvlcmetadata of oapvvlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

4 affected componentsFixes available

android/platform/external/libopenapv>=16:0<16:2026-11-01

16:2026-11-01

android/platform/external/libopenapv>=16-qpr2:0<16-qpr2:2026-11-01

16-qpr2:2026-11-01

android/platform/external/libopenapv>=17:0<17:2026-11-01

17:2026-11-01

Google Android

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade android/platform/external/libopenapv to a version that resolves this vulnerability.
Fixed in 16:2026-11-01
Upgrade
Upgrade android/platform/external/libopenapv to a version that resolves this vulnerability.
Fixed in 16-qpr2:2026-11-01
Upgrade
Upgrade android/platform/external/libopenapv to a version that resolves this vulnerability.
Fixed in 17:2026-11-01

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Nov 2, 2026

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and user involvement are required for exploitation?

The vulnerability is rated with a local attack vector and requires low attack complexity. No privileges or user interaction are required according to the supplied metrics and description.

Which software components are identified as affected?

The affected software is identified as Android's external libopenapv component, in the android/platform/external/libopenapv project. Google Android is also listed.

Can exposure be determined from affected-version information?

No affected version ranges or fixed versions are provided in the supplied data. The listed references may contain the version-specific remediation details.

CVE-2026-58968: Double Free

Affected Software

Remediation

Event History

Frequently Asked Questions

What access and user involvement are required for exploitation?

Which software components are identified as affected?

Can exposure be determined from affected-version information?

Company

Resources

Contact

Frequently Asked Questions

What access and user involvement are required for exploitation?

Which software components are identified as affected?

Can exposure be determined from affected-version information?