Google Android up to 17 ParsingUtils.java parseKnownActivityEmbeddingCerts input validation
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 5.3 | $5k-$25k | 0.40+ |
Summary
A vulnerability, which was classified as critical, has been found in Google Android 14/15/16/16-qpr2/17. Affected is the function parseKnownActivityEmbeddingCerts of the file ParsingUtils.java. Performing a manipulation results in input validation.
This vulnerability is identified as CVE-2026-58817. The attack is only possible with local access. There is not any exploit available.
To fix this issue, it is recommended to deploy a patch.
Details
A vulnerability classified as critical has been found in Google Android 14/15/16/16-qpr2/17. This affects the function parseKnownActivityEmbeddingCerts of the file ParsingUtils.java. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly. This is going to have an impact on availability. The summary by CVE is:
In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
It is possible to read the advisory at source.android.com. This vulnerability is uniquely identified as CVE-2026-58817 since 07/02/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 11/02/2026).
Applying a patch is able to eliminate this problem.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Product
Type
Vendor
Name
Version
License
Website
- Vendor: https://www.google.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.5VulDB Meta Temp Score: 5.3
VulDB Base Score: 5.5
VulDB Temp Score: 5.3
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Input validationCWE: CWE-20
CAPEC: 🔒
ATT&CK: 🔒
Physical: Partially
Local: Yes
Remote: No
Availability: 🔒
Status: Not defined
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔒
Timeline
07/02/2026 CVE reserved11/02/2026 Advisory disclosed
11/02/2026 VulDB entry created
11/02/2026 VulDB entry last update
Sources
Vendor: google.comAdvisory: source.android.com
Status: Confirmed
CNA: google_android
CVE: CVE-2026-58817 (🔒)
GCVE (CVE): GCVE-0-2026-58817
GCVE (VulDB): GCVE-100-430011
scip Labs: https://www.scip.ch/en/?labs.20150917
Entry
Created: 11/02/2026 21:16Changes: 11/02/2026 21:16 (58)
Complete: 🔍
Cache ID: 216::103
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.