Google Android CVE-2026-58995

Exploitation requires LOCAL access (AV:L): the attacker must already be able to run code on the device, typically via an installed or compromised unprivileged app, which then drives a privileged component to parse attacker-controlled data through getEntryFileName in ZipFileRO.cpp (the ZIP central-directory entry-name read path). No elevated privileges (PR:N) and no user interaction (UI:N) are needed once local code execution exists. The precise malformed input that triggers the overflow is not detailed in the available sources. Limiting factors: the vulnerability is not remotely reachable, requires prior local execution, and affects only Android versions 14 through 17; devices patched per the 2026-11-01 Android Security Bulletin are not affected.

This is a locally-exploitable heap buffer overflow (CWE-122) in Android's native ZipFileRO.cpp. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4 HIGH) is internally consistent with the description: the attack vector is LOCAL (not network), complexity is low, no privileges are required per Google's bulletin convention ('no additional execution privileges needed'), and impact is full C/I/A compromise within an unchanged scope - i.e. local privilege escalation. The exploitation signals, however, are modest: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit or PoC reference is present in the supplied data, so the status is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a real-but-not-urgent priority. The key tension is high CVSS severity (8.4) versus very low real-world exploitation probability (EPSS 2nd percentile, no KEV): this reflects a serious memory-safety defect whose exploitation requires local code execution first, which tempers the practical risk relative to the raw score. Note the LOCAL vector means this is not remotely reachable despite PR:N; the 'unauthenticated' reading of PR:N here means no elevated privileges, not network-remote access.

A malicious or compromised low-privilege application already present on the device causes a privileged Android component to parse a crafted ZIP archive via ZipFileRO, triggering a heap buffer overflow in getEntryFileName and corrupting adjacent heap memory. No user interaction is required. If the overflow is shaped into reliable control-flow or data corruption, the attacker gains code execution in a higher-privileged context, escalating privilege; no public exploit code is identified in the available data.