CVE-2026-58822

9.8 criticalEPSS 0.4%

Critical (9.8) in google android. EPSS 0.4% chance of exploitation in the next 30 days.

In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-704
Published: 2026-09-08
Modified: 2026-09-24
Record from: the NVD, synced 2026-10-19

Affected

google:android

References

https://source.android.com/docs/security/bulletin/2026/2026-09-01

Check your stack JSON