Google Android CVE-2026-58859

Exploitation requires local access to an Android 17 device with at least low-level privileges (PR:L) - in practice, the ability to run code such as a malicious or compromised third-party application already present on the device. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker has that local foothold the flaw is reliably triggerable against default configurations. The primary limiting factors are the need for prior local presence (no remote/network exploitation is possible under AV:L) and the restriction to the Android 17 version listed in the EUVD data; devices on other Android versions are not indicated as affected by the provided intelligence.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity, low-privilege attack requiring no user interaction, with high confidentiality, integrity, and availability impact - a classic Android local elevation-of-privilege profile. No EPSS probability, CISA KEV listing, SSVC decision data, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Because the attack vector is local (AV:L), an attacker must already have a foothold on the device (e.g., a malicious or compromised app running at low privilege), which materially limits real-world risk compared with a network-exploitable flaw despite the 'High' severity rating. Note a tension in the source data: the description frames the root cause as a denial of service from an uncaught exception (CWE-248), yet the CVSS asserts C:H/I:H/A:H and the stated consequence is privilege escalation - the DoS/uncaught-exception phrasing is Android-bulletin boilerplate and the escalation-of-privilege outcome should be treated as the authoritative impact; verify specifics against the Android bulletin when it publishes full detail.

A malicious application installed on an Android 17 device, running with only low/normal app privileges and no special permissions, invokes a vulnerable code path that mishandles an exception condition. Exploiting this flaw locally and without any user interaction, the app escalates to elevated privileges beyond what it was granted. No public exploit code was identified in the provided data.