Google Android CVE-2026-58988

Exploitation requires the attacker to already have local code execution on the device (AV:L) - in practice a malicious or compromised app - that can reach the isValid routine in ShimConverter.cpp and supply input that passes the missing bounds check to force an out-of-bounds read. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the local-only vector is the primary limiting factor: there is no remote exploitation path, and impact is confined to disclosure of a limited amount of memory (C:L, no integrity or availability impact). Affected deployments are Android 14, 15, 16, 16-qpr2 and 17; devices patched per the 2026-11-01 Android Security Bulletin are not affected.

This is a genuinely low-priority issue despite being a memory-safety bug. The CVSS 3.1 base score is 4.0 (Medium) driven entirely by a local attack vector (AV:L), no privileges (PR:N), no user interaction (UI:N) and a limited confidentiality impact only (C:L/I:N/A:N) - i.e. an on-device out-of-bounds read that can leak small amounts of memory. All real-world exploitation signals point the same low direction and do not conflict: EPSS is 0.11% (1st percentile), there is no CISA KEV listing (not actively exploited), and no public exploit or PoC reference is present in the supplied data. The only mildly elevating signal is the vuln.today priority of 'this_month', which reflects Android's reach rather than active attack. There is no SSVC decision vector, no 'automatable' flag and no technical-impact rating supplied, so a formal SSVC conclusion cannot be stated from the input. Net: this is a low-real-risk information-disclosure flaw that happens to sit in a ubiquitous product; patch it in the normal monthly Android cycle rather than as an emergency.

A malicious or compromised application already present on the device invokes the vulnerable isValid code path in ShimConverter.cpp with crafted input that bypasses a missing bounds check, causing an out-of-bounds read that discloses adjacent process memory. No user interaction and no additional execution privileges are required, but the attacker must already be running code locally on the device. No public exploit or PoC reference is identified in the available data.