Android CVE-2026-58955

Exploitation requires local access to the device - specifically the ability to run code that reaches the notification-channel update path (updateNotificationChannel in PreferencesHelper.java), which per the CVSS vector needs no additional execution privileges (PR:N) and no user interaction (UI:N). The key limiting factor is AV:L: there is no remote or network-reachable path, so an attacker must already have a foothold (e.g., a malicious installed app) on an affected Android build (Android 14, 15, 16, 16-qpr2, or 17). Impact is confined to local denial of service / UI obfuscation with no confidentiality or integrity effect.

This is a genuinely low-priority issue despite a mid-range CVSS base score of 6.2. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) shows the only impact is availability (A:H) with zero confidentiality or integrity impact, and the attack vector is LOCAL (AV:L) - meaning an attacker must already be able to run code on the device, not reach it over a network. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with the weak exploitation signals: EPSS is only 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit was identified. No signals conflict here - every source points the same direction: a real but low-severity local denial-of-service bug (a UI obfuscation / logic error in notification-channel handling) that is unlikely to be mass-exploited. The practical outcome is a local DoS or UI spoofing/obfuscation effect rather than code execution or data theft, so this is a routine monthly-patch item rather than an urgent priority.

A malicious or compromised application already installed on an Android device calls into the notification-channel update path (updateNotificationChannel in PreferencesHelper.java), triggering the logic error to cause UI obfuscation or a denial-of-service condition on the local device. Because the CVSS vector is AV:L with UI:N, no remote access and no victim interaction are required, but the attacker must first have local code-execution on the device. No public proof-of-concept or exploit code was identified in the provided sources.