October 2026: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 0 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r30 adds the fix for 1 CVE: CVE-2026-58865.

android-security-15.0.0_r18 adds the fix for 1 CVE: CVE-2026-58865.

android-security-16.0.0_r9 adds the fix for 2 CVEs: CVE-2026-58865, CVE-2026-58880.

android-security-17.0.0_r2 adds the fix for 2 CVEs: CVE-2026-58865, CVE-2026-58880.

Announced, with no public code

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 14: 1 fix in android-security-14.0.0_r30

Android 15: 1 fix in android-security-15.0.0_r18

Android 16: 1 fix in android-security-16.0.0_r9

Android 17: 1 fix in android-security-17.0.0_r2

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2026-28667 · platform/system/nfc (Android 14/15) and platform/packages/modules/Nfc libnfc-nci (Android 16/17)
  Adds a response-length check (length < p_i93->block_size) before three rw_i93_send_cmd_write_single_block calls in rw_t5t.cc, so a short tag response no longer leads to stale GKI buffer bytes being sent over RF in a WRITE_SINGLE_BLOCK command.
• CVE-2026-45513 · platform/system/nfc (Android 14/15) and platform/packages/modules/Nfc libnfc-nci (Android 16/17)
  Adds a length check in nfc_main_hal_data_cback (libnfc-nci nfc_main.cc). An incoming HAL data packet larger than the fixed NFC_NCI_POOL_ID GKI buffer capacity is now logged and dropped instead of being placed in a pool buffer that is too small.
• CVE-2026-45516 · platform/external/freetype
  Adds an unsigned-multiplication wraparound check on per_region_size * item_count in tt_var_load_item_variation_store (src/truetype/ttgxvar.c) before varData->deltaSet is allocated. When the product wraps, the function now returns Array_Too_Large.
• CVE-2026-45524 · platform/packages/modules/Wifi
  WifiPermissionsUtil#isSystem now returns false for Private Compute Core UIDs (when SdkLevel.isAtLeastC()), so PCC callers are no longer treated as system apps for Wi-Fi permission decisions.
• CVE-2026-49878 · platform/external/wpa_supplicant_8
  Replaces two undersized os_zalloc(num_active_scs) allocations for the int arrays scs_resp[0] and scs_resp[1] in wpas_handle_robust_av_scs_recv_action with os_calloc(num_active_scs, sizeof(int)). This fixes the heap out-of-bounds write in the SCS Response handler.
• CVE-2026-49880 · platform/packages/modules/Nfc
  Adds an allocated-size field (p_dataBuf_len) to the T4T NFCEE control block and checks rd_offset + p_data->len against it before the memcpy in nfa_t4tnfcee_store_rx_buf, plus length guards in nfa_t4tnfcee_check_sw and nfa_t4tnfcee_store_cc_info and NULL checks on the two nfa_mem_co_alloc results.
• CVE-2026-49885 · platform/system/nfc (Android 14/15) and platform/packages/modules/Nfc libnfc-nci (Android 16/17)
  Adds a check in rw_t4t_set_ber_tlv() that p_t4t->max_update_size is larger than the ODO/DDO data header before computing data_length = max_update_size - data_header (in both realignment branches), and makes the caller rw_t4t_update_file() free the C-APDU GKI buffer when rw_t4t_set_ber_tlv() fails.
• CVE-2026-49933 · platform/packages/modules/Bluetooth
  Default-initializes MsftExtensionManager::impl::scanning_callbacks_ to nullptr and adds a null check in handle_le_monitor_device_event, so a MSFT LE monitor device vendor event received before the scanning callbacks are registered is dropped instead of invoking a virtual method through an indeterminate pointer.
• CVE-2026-49937 · platform/system/libfmq
  Adds bounds validation in libfmq's MessageQueueBase for kSynchronizedReadWrite queues. availableToReadBytes() now rejects a write/read pointer pair that claims more available bytes than the queue size, and beginRead() now rejects up front any read request larger than the queue's quantum count.
• CVE-2026-55266 · platform/system/libufdt
  Rewrites the partition handling of the copied BSD qsort in libufdt's vendor sysdeps so that it recurses on the smaller partition and iterates on the larger one, bounding recursion depth to O(log n) instead of O(n) on adversarial inputs.
• CVE-2026-55269 · platform/packages/modules/Bluetooth
  Corrects an inverted size guard in SnoopLogger::FilterCapturedPacket. Short HCI ACL packets are now padded by EXTRA_BUF_SIZE before profile filtering writes the fixed "PROHIBITED" magic string into the packet buffer. The fix also clamps the output length to packet.size() + PACKET_TYPE_LENGTH.
• CVE-2026-55270 · platform/frameworks/opt/telephony
  Adds a `wrappedCallback == null` guard before `handleInCallMmiCommands(newDialString)` in `dialInternal` of both `GsmCdmaPhone` and `ImsPhone`, so that USSD requests (which carry a non-null ResultReceiver) are no longer interpreted as in-call MMI supplementary-service commands.
• CVE-2026-55279 · platform/system/fs/fs_mgr
  ImageManager::MapAllImages in libfiemap now logs an error and returns false when the metadata directory does not exist, instead of silently returning true, so first-stage init no longer treats a non-existent or invalid DSU slot as a successfully mapped, running DSU.
• CVE-2026-55280 · platform/packages/modules/Nfc
  Zero-initializes the whole evt_data.activate structure in nfc_ncif_proc_activate() and clamps the NFCID1 and Kovio UID length fields in nfa_dm_notify_activation_status(). The goal is that a short or malformed RF_INTF_ACTIVATED_NTF from the NFCC can no longer feed uninitialized or oversized length values into a memcpy in the NFC process.
• CVE-2026-55286 · platform/hardware/st/nfc
  Adds an early length check in stpropnci_process() (ST NFC HAL, libstpropnci) that drops and logs any NCI message whose payloadlen exceeds MAX_NCI_MESSAGE_LEN.
• CVE-2026-58815 · platform/frameworks/av
  Changes the per-region loop bound in the camera metering-region mappers (DistortionMapper, RotateAndCropMapper, ZoomRatioMapper) from `j < entry.count` to `j + 5 <= entry.count`. A 5-int32 region tuple is now processed only when all five elements lie inside the metadata entry, which prevents heap out-of-bounds read and write when the region array length is not a multiple of 5.
• CVE-2026-58834 · platform/frameworks/base
  Adds an argument check in DevicePolicyManagerService.setPermissionGrantState that rejects any grantState other than GRANTED, DENIED or DEFAULT, and wraps the per-policy enforcePolicy calls in DevicePolicyEngine's policy re-apply loop in try/catch so that a bad persisted policy is logged with Slogf.wtf instead of crashing system_server.
• CVE-2026-58835 · platform/packages/modules/Bluetooth
  In system/btif/src/btif_storage.cc cfg2prop(), the BT_PROPERTY_UUIDS / BT_PROPERTY_UUIDS_LE path now limits btif_split_uuids_string() to the caller-supplied buffer capacity (prop->len / sizeof(Uuid)) instead of the hardcoded BT_MAX_NUM_UUIDS.
• CVE-2026-58841 · platform/frameworks/base
  VirtualAudioController.startListening now registers mAudioPlaybackDetector unconditionally instead of only when an IAudioConfigChangedCallback is supplied, so per the commit message the deferred silence-injection policy update recovers correctly when no config-changed callback is provided.
• CVE-2026-58854 · platform/frameworks/av
  Adds isRemote() (and, where missing, nullptr) validation before static_cast downcasts of caller-supplied ITunerFilter/ITunerDemux/ITunerLnb interface pointers in the mediatuner service, across both the AIDL and HIDL backends, rejecting remote binder proxies with Result::INVALID_ARGUMENT.
• CVE-2026-58856 · platform/frameworks/av
  Adds a range check on the output slot index, a null check on the slot's GraphicBuffer, and a checked lookup in mBuffers in Camera3StreamSplitter::returnOutputBufferLocked. It also changes the outputSlots local from a copy to a reference.
• CVE-2026-58859 · platform/packages/modules/Telephony
  Changes catch (Exception) to catch (Throwable) in Ts43PhoneNumberRetriever.fetchPhoneNumber and adds a new catch (Throwable) in the Ts43PhoneNumberController fetch method, so a StackOverflowError from JSON parsing of a server response no longer escapes and crashes the process.
• CVE-2026-58865 · platform/frameworks/base
  Adds a bounds check on the well-known content-type index in PduParser.parseContentType and null checks on the parameter map and the parsed charset string in PduParser.parseContentTypeParams so a malformed MMS PDU no longer throws ArrayIndexOutOfBoundsException or NullPointerException out of PduParser.parse().
• CVE-2026-58880 · platform/packages/modules/Bluetooth
  Removes the num_ext_attr/ext_attrs parameters from the AVRCP controller playerapplicationsetting_cb HAL callback, so the callback no longer carries a pointer to ext_attrs data that handle_app_attr_val_txt_response frees. It also makes that free (cleanup_app_attr_val_txt_response) synchronous instead of posting it to the JNI thread.

Bulletin revisions

• No change seen since tracking started (2026-10-05).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).