Android CVE-2026-58839

Exploitation requires local code execution on the target Android device with at minimum a low-privileged application context (PR:L). The attacker must be able to trigger the storage volume management subsystem's forEachLine parsing routine, which occurs during normal mount registry operations. No user interaction is required once the attacker's code is executing on the device. Exploitation is bounded by the requirement for prior local code execution - remote unauthenticated exploitation is not possible given AV:L. Devices running Android 14, 15, 16, or 16-qpr2 that have not applied the September 2026 security patch are vulnerable. SSVC notes the attack is not automatable, suggesting reliable exploitation requires targeted effort rather than trivial scripted abuse.

The CVSS 7.8 base score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local, low-complexity privilege escalation with total system impact. SSVC corroborates the severity with a 'total' technical impact rating, though it also notes exploitation status as 'none' and automatable as 'no', meaning opportunistic mass exploitation is unlikely. EPSS data is absent from the provided intelligence; however, the combination of a locally exploitable memory corruption primitive, no user interaction requirement, and total impact across four Android versions represents a meaningful real-world risk - particularly for rooted-device threats, malicious applications that have obtained low-privilege execution, or post-initial-access scenarios. The absence of KEV listing and no public POC at time of analysis moderates urgency relative to the raw CVSS score. The local attack vector limits the threat primarily to on-device exploitation rather than remote network-based attacks.

An attacker installs a malicious application granted only standard low-privilege permissions, or exploits a separately compromised app process already running on the device. The malicious code triggers the forEachLine buffer overflow in MountRegistry.cpp by inducing the storage subsystem to process crafted or oversized line data, corrupting adjacent memory. This memory corruption is then leveraged to redirect execution flow and escalate privileges to a higher system process level, granting full read/write/execute control over the device.