by Kastro
Paper/Archive/CVE-2026-58822

CVE-2026-58822

Google Android — In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting.

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 32.3.323 × 206.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

ProductAffectedFixed inSource
Android17–CNA
Android16-qpr2–CNA
Android16–CNA
Android15–CNA
Android14–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsource.android.com/docs/security/bulletin/2026/2026-09-01