CVE-2026-58868 is a critical Android vulnerability that can enable remote code execution without user interaction on devices running Android 14 through 17. The flaw stems from a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp, causing an out-of-bounds write that could let an attacker execute arbitrary code. Exploitation requires no additional execution privileges, making it a potential zero-click attack. Google has fixed CVE-2026-58868, and devices receive the fix through security patch level 2026-11-01 or later, depending on manufacturers and carriers. Google’s November 2026 Android security bulletin notes active exploitation of this flaw and also lists other critical issues in System, Framework, kernel, MediaTek modem and Qualcomm components. 1