{"id":"CVE-2026-58835","published":"2026-10-05T19:17:24.650","lastModified":"2026-10-07T15:12:08.233","description":"In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":["google"],"products":["android"],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is a heap buffer overflow in the cfg2prop function of btif_storage.cc, which could lead to remote code execution. This matters because it allows an attacker to execute arbitrary code without additional privileges, posing a significant security risk.","exploitability":"Exploitation is relatively straightforward with no user interaction required. An attacker needs access to the affected system and the ability to trigger the vulnerability.","blast_radius":"If exploited, this could result in complete control of the affected system, leading to data theft, system compromise, and potential propagation of the exploit to other systems.","remediation":"Upgrade to the latest version of the affected software, as no specific version was mentioned in the description. Follow the vendor's advisory for detailed instructions.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","heap-overflow","remote-code-execution","security-vulnerability","software-update"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:45:10.688Z"}}