CVE-2026-58834

Published: Oct 5, 2026Modified: Oct 7, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected (7)

Products: Google: Android

Google

1 product

Android

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Google Android	Version 14.0
Google Android	Version 15.0
Google Android	Version 16.0
Google Android	Version 16.0 qpr2_beta_1
Google Android	Version 16.0 qpr2_beta_2
Google Android	Version 16.0 qpr2_beta_3
Google Android	Version 17.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (1)

https://source.android.com/docs/security/bulletin/2026/2026-10-01

Source: security@android.com

PatchVendor Advisory

Timeline

No history available yet.