How severe is CVE-2026-58822?

CVE-2026-58822 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-58822 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-58822?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2026-58822 published?

CVE-2026-58822 was published on 2026-09-08.

CVE-2026-58822

CVE-2026-58822 is a critical-severity vulnerability with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-704.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 0% (24th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-704
Published: 2026-09-08
Last modified: 2026-09-08

Description

In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Frequently asked questions

What is CVE-2026-58822?: In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
How severe is CVE-2026-58822?: CVE-2026-58822 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-58822 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-58822?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2026-58822 published?: CVE-2026-58822 was published on 2026-09-08.

References

https://source.android.com/docs/security/bulletin/2026/2026-09-01

Other CWE-704 (Incorrect Type Conversion or Cast) vulnerabilities

CVE-2015-3120 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before…
CVE-2026-15826 — Critical (CVSS 9.8): The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up…
CVE-2025-39880 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to…
CVE-2025-41648 — Critical (CVSS 9.8): An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it…
CVE-2025-41646 — Critical (CVSS 9.8): An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect…
CVE-2021-33318 — Critical (CVSS 9.8): An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and…

Browse all CWE-704 (Incorrect Type Conversion or Cast) vulnerabilities →