CVE-2026-58977
Received
Received - Intake
Memory Corruption in Android System Component
Vulnerability report for CVE-2026-58977, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-02
Last updated on: 2026-11-02
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
