Google’s November 2026 Android security bulletin lands with 216 vulnerabilities patched, 23 of them Critical — including a zero-click remote code execution flaw that needs no user interaction and an “SMS of Death” bug that crashes your phone’s calling service with one crafted text. The proof-of-concept for the SMS flaw is already public. There are no confirmed in-the-wild attacks today. That’s your window.
CVE-2026-58868: Zero-Click RCE in the Android Framework
The headline flaw is CVE-2026-58868, a heap buffer overflow in FrameDecoder.cpp inside the Android Framework’s onOutputReceived function. The root cause is insufficient validation of incoming data lengths — an attacker can craft input that writes beyond the allocated heap buffer, potentially allowing arbitrary code execution without the target doing anything at all.
Affected versions: Android 14, 15, 16, 16 QPR2, and 17. The fix is in patch level 2026-11-01, the first of two patch batches in this bulletin. This is not delivered as a Play system update — your fleet needs OEM or carrier firmware, which means patch timing depends entirely on your hardware vendors.
CVE-2026-58868 is not yet on CISA’s Known Exploited Vulnerabilities catalog. A Critical Framework RCE with zero interaction required is exactly the class of bug that moves there fast once someone weaponizes it.
CVE-2026-58882: The SMS of Death
The second critical flaw is CVE-2026-58882, and it has an uncomfortable feature: a proof-of-concept is already public. Sending a specially crafted WAP Push message to a vulnerable phone — requiring nothing more than the target’s phone number — causes the com.android.phone process to crash. That crash disrupts cellular connectivity, terminates active calls, and can trigger a reboot loop if the attacker repeats the message.
The root cause is an unchecked integer conversion in WapPushOverSms.java that turns a message header length into a negative value, triggering an exception before Android can allocate memory. The message is processed at the system level, before it ever reaches the user’s inbox.
Android 14 through 17 receive a fix with the 2026-11-01 patch level. Android 12 and 13 do not. Google has not committed to backporting this fix, leaving every device still running those versions permanently exposed to a denial-of-service attack that disrupts calling and cellular.
Two Patch Levels: What They Cover
The November Android Security Bulletin ships in two batches:
- 2026-11-01: 119 fixes, 8 Critical. Covers Android Runtime, Framework, and System components. This level addresses both CVE-2026-58868 and CVE-2026-58882.
- 2026-11-05: 97 additional fixes, 15 Critical. Covers Linux kernel (Bluetooth, human interface devices, protected virtualization), plus 8 critical MediaTek modem flaws and a Qualcomm closed-source fix. Full protection requires this level.
A device at 2026-11-01 is protected from the two headline CVEs. A device at 2026-11-05 is protected from everything in this bulletin — including critical kernel-level flaws in Bluetooth and pKVM that the first batch doesn’t touch.
What You Need to Do Now
For fleet and enterprise administrators:
- Pull a patch-level report from your MDM (Intune, Jamf, Workspace ONE). Flag every device below 2026-11-01 as critical priority.
- Sort by last check-in date to surface idle devices that may skip update prompts.
- Devices on Android 12 or 13: assess whether they handle calls or sensitive data. The SMS of Death fix is not coming for those versions.
- Target 2026-11-05 as your fleet-wide goal for complete bulletin coverage.
For app developers: if your application handles telephony or uses WAP Push APIs, test its behavior when com.android.phone crashes unexpectedly. Applications that process media streams via Android Framework should audit indirect dependencies on FrameDecoder. You can check the device’s current patch level programmatically:
val patchLevel = Build.VERSION.SECURITY_PATCH // e.g., "2026-11-05"The Quiet Risk in This Bulletin
The zero-click RCE grabs headlines, but CVE-2026-58882 is the flaw keeping security teams up tonight. A PoC is public. The attack requires only a phone number. Android 12 and 13 — still running on millions of corporate and personal devices globally — have no fix on the roadmap. The November patch does not deliver itself, especially on carrier-locked hardware. Organizations with Android 12/13 devices in critical workflows need to make a decision this week: enforce MDM controls, restrict those devices, or start a hardware refresh. This week’s OpenSSH Alpine CVE is a reminder that “no exploits in the wild” lasts until it doesn’t. The same logic applies here.
Full technical details on both vulnerabilities are covered by The Hacker News and Security Affairs.
