CVE-2026-58988: Buffer Overflow

Q: Who can exploit this issue?

An attacker needs local access to the affected Android components. No additional execution privileges or user interaction are required.

Q: What is the likely impact if exploitation succeeds?

The documented impact is local information disclosure caused by an out-of-bounds read. Integrity and availability impacts are not indicated by the supplied severity vector.

Q: Which Android code areas should be reviewed for exposure?

Review deployments containing android/platform/hardware/interfaces or android/platform/packages/modules/neuralnetworks, particularly code paths using ShimConverter.cpp and its isValid function.

Published Nov 1, 2026

Updated

In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

13 affected componentsFixes available

android/platform/hardware/interfaces>=17-qpr2-next:0<17-qpr2-next:2026-11-01

17-qpr2-next:2026-11-01

android/platform/packages/modules/neuralnetworks>=17-qpr2-next:0<17-qpr2-next:2026-11-01

17-qpr2-next:2026-11-01

android/platform/hardware/interfaces>=15:0<15:2026-11-01

15:2026-11-01

android/platform/packages/modules/neuralnetworks>=15:0<15:2026-11-01

15:2026-11-01

android/platform/hardware/interfaces>=16:0<16:2026-11-01

16:2026-11-01

android/platform/packages/modules/neuralnetworks>=16:0<16:2026-11-01

16:2026-11-01

android/platform/hardware/interfaces>=16-qpr2:0<16-qpr2:2026-11-01

16-qpr2:2026-11-01

android/platform/packages/modules/neuralnetworks>=16-qpr2:0<16-qpr2:2026-11-01

16-qpr2:2026-11-01

android/platform/hardware/interfaces>=17:0<17:2026-11-01

17:2026-11-01

android/platform/packages/modules/neuralnetworks>=17:0<17:2026-11-01

17:2026-11-01

android/platform/hardware/interfaces>=14:0<14:2026-11-01

14:2026-11-01

android/platform/packages/modules/neuralnetworks>=14:0<14:2026-11-01

14:2026-11-01

Google Android

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade android/platform/hardware/interfaces to a version that resolves this vulnerability.
Fixed in 17-qpr2-next:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/NeuralNetworks to a version that resolves this vulnerability.
Fixed in 17-qpr2-next:2026-11-01
Upgrade
Upgrade android/platform/hardware/interfaces to a version that resolves this vulnerability.
Fixed in 15:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/NeuralNetworks to a version that resolves this vulnerability.
Fixed in 15:2026-11-01
Upgrade
Upgrade android/platform/hardware/interfaces to a version that resolves this vulnerability.
Fixed in 16:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/NeuralNetworks to a version that resolves this vulnerability.
Fixed in 16:2026-11-01
Upgrade
Upgrade android/platform/hardware/interfaces to a version that resolves this vulnerability.
Fixed in 16-qpr2:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/NeuralNetworks to a version that resolves this vulnerability.
Fixed in 16-qpr2:2026-11-01
Upgrade
Upgrade android/platform/hardware/interfaces to a version that resolves this vulnerability.
Fixed in 17:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/NeuralNetworks to a version that resolves this vulnerability.
Fixed in 17:2026-11-01
Upgrade
Upgrade android/platform/hardware/interfaces to a version that resolves this vulnerability.
Fixed in 14:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/NeuralNetworks to a version that resolves this vulnerability.
Fixed in 14:2026-11-01

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Nov 2, 2026

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

Description

Data Sourced

via NVD·08:17 PM

SeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs local access to the affected Android components. No additional execution privileges or user interaction are required.

What is the likely impact if exploitation succeeds?

The documented impact is local information disclosure caused by an out-of-bounds read. Integrity and availability impacts are not indicated by the supplied severity vector.

Which Android code areas should be reviewed for exposure?

Review deployments containing android/platform/hardware/interfaces or android/platform/packages/modules/neuralnetworks, particularly code paths using ShimConverter.cpp and its isValid function.

CVE-2026-58988: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

Which Android code areas should be reviewed for exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

Which Android code areas should be reviewed for exposure?