android vulnerabilities and fixes

Recent CVEs affecting android, with upgrade or downgrade steps. 18 tracked.

android has 18 tracked vulnerabilities, 1 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 3. Most recent: 2026-09-15. Highest priority: CVE-2026-58704 (score 68/100).

• CVE-2026-0163 CRITICAL 9.8 MITIGATE In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free
• CVE-2026-21061 MEDIUM 6.5 MITIGATE Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access
• CVE-2026-21068 HIGH 7.8 MITIGATE Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers
• CVE-2026-21065 HIGH 7.8 MITIGATE Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write
• CVE-2026-21066 HIGH 7.8 MITIGATE Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers t
• CVE-2026-21067 HIGH 7.8 MITIGATE Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of
• CVE-2026-21069 HIGH 7.8 MITIGATE Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows
• CVE-2026-21071 HIGH 7.8 MITIGATE Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attacker
• CVE-2026-21072 HIGH 7.8 MITIGATE Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers
• CVE-2026-21058 HIGH 7.1 MITIGATE Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete
• CVE-2026-21059 HIGH 7.1 MITIGATE Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows l
• CVE-2026-21063 MEDIUM 6.1 MITIGATE Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical a
• CVE-2026-21073 MEDIUM 6.1 MITIGATE Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch
• CVE-2026-21064 MEDIUM 5.5 MITIGATE Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inope
• CVE-2026-21060 MEDIUM 4.6 MITIGATE Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to acc
• CVE-2026-21070 MEDIUM 4.6 MITIGATE Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to acce
• CVE-2026-21062 LOW 3.3 MITIGATE Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access c
• CVE-2026-58704 HIGH 8.8 EXPLOITED MITIGATE Google Pixel Improper Authorization Vulnerability

FAQ

How do I fix android vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is android being exploited right now?

Yes: 1 android CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which android CVE should I patch first?

CVE-2026-58704 currently ranks highest (68/100): Google Pixel Improper Authorization Vulnerability.

← Back to latest CVEs