Google Android CVE-2026-58875

Requires local access to run code on the affected device - exploitation is not remote (AV:L). A local, unprivileged process (e.g., an installed app or an attacker with ADB/shell access) can trigger the flaw with no additional execution privileges (PR:N) and no user interaction (UI:N) by supplying malformed input to the affected component(s). The exact feature, interface, or malformed input that triggers the improper input validation is not described in the available sources ('multiple locations'). The principal limiting factor is the local attack vector: the attacker must already have a foothold on the device, which substantially narrows realistic exposure. Affected builds are Android 14, 15, 16, 16-qpr2, and 17.

Signals are consistent and point to a genuine but low-urgency issue. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.2) describes a locally-reachable availability-only flaw: an attacker needs local access to the device but requires no privileges (PR:N) and no user interaction (UI:N), and impact is confined to denial of service (A:H, with C:N/I:N - no data exposure or code execution). EPSS is very low at 0.11% (1st percentile), and there is no CISA KEV listing and no public exploit or PoC reference in the supplied data, so this is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month' - a routine patch cadence, not act_now/emergency - which aligns with the low EPSS and absence of active exploitation. This is therefore a real but modest priority: a local, availability-only bug rather than a high-CVSS issue masking low real risk, but also not an emergency. Note the AV:L (local) vector contrasts with the ubiquity of the product - exploitation requires on-device code execution, which meaningfully constrains real-world reach despite Android's enormous install base.

A malicious or compromised application already installed on the device (or an attacker with local shell/ADB access) sends malformed input to one of the affected Android components, where improper input validation (CWE-20) triggers a crash or hang that denies service. No elevated privileges or user interaction are needed, but the attacker must already be running code locally on the device. No public exploit or PoC is identified in the available data.