CVE-2026-59618: Integer Overflow

Q: What level of access does an attacker need?

Exploitation is described as local and does not require additional execution privileges. No user interaction is required.

Q: Which Android versions or builds are affected?

The supplied data identifies the software as Android but does not specify affected versions or builds.

Published Nov 1, 2026

Updated

In smfcv4l2sselection of smfc-v4l2-ioctls.c, there is a possible way to trigger an out of bounds read from adjacent shared memory buffers due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

1 affected componentFixes available

android/:unknown:>=Pixel-family specific:0<Pixel-family specific:2026-11-05

Pixel-family specific:2026-11-05

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

What level of access does an attacker need?

Exploitation is described as local and does not require additional execution privileges. No user interaction is required.

Which Android versions or builds are affected?

The supplied data identifies the software as Android but does not specify affected versions or builds.

CVE-2026-59618: Integer Overflow

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

Which Android versions or builds are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Which Android versions or builds are affected?