Google Android CVE-2026-58853

Exploitation requires the attacker to deliver crafted input that reaches the vulnerable IPP-helper parsing code (ipphelper.c) across Android versions 14 through 17, including 16-qpr2. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Google's description, no authentication and no user interaction are required, suggesting a network-reachable attack surface against affected default builds; however, the available sources do not specify whether the IPP listener/printing service must be active or exposed, so the realistic attack surface depends on whether that component is reachable on a given device or network. The impact is limited to denial of service (A:H, C:N/I:N) - no code execution or data exposure - which itself bounds the consequence.

Multiple signals converge on this being a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact and high availability impact - consistent with the description's 'remote denial of service with no additional execution privileges needed' and 'user interaction is not needed.' The SSVC framework tempers this: Exploitation is 'none' (no observed or public exploitation), Technical Impact is only 'partial,' though Automatable is 'yes,' meaning the trigger could be scripted at scale if an exploit emerged. There is no CISA KEV listing and no EPSS score provided, so widespread-exploitation probability cannot be quantified from the input. No POC or exploit reference appears in the data. The vuln.today Decision label is 'this_week,' indicating near-term but not emergency remediation. Net: a real, broadly-applicable availability bug given Android's footprint, but with no evidence of exploitation and no code-execution consequence, this is a 'patch in the normal fast cycle' issue rather than a drop-everything emergency.

A remote attacker on a network path to the device sends crafted IPP (Internet Printing Protocol) traffic that reaches the vulnerable parsing code in ipphelper.c, where a missing bounds check causes a stack buffer overflow. Because no user interaction or privileges are required, the malformed input alone crashes the affected component, producing a denial of service. No public exploit code is identified in the available data, and the description limits impact to DoS with no additional execution privileges.