{"metadata": {"vulnerability": "CVE-2026-58936", "count": 35, "kinds": {"milestone": 8, "sighting": 8, "kev": 0, "other": 19}, "linked_omitted": 0}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0467", "record": "NCSC-2026-0467", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-07-02T06:14:16.313Z", "date_only": false, "value": "2026-07-02T06:14:16.313Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-58936", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-02T00:00:00Z", "date_only": true, "value": "2026-11-02", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1443", "record": "CERTFR-2026-AVI-1443", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-11-02T19:54:09.925Z", "date_only": false, "value": "2026-11-02T19:54:09.925Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58936", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-02T19:54:09.925Z", "date_only": false, "value": "2026-11-02T19:54:09.925Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / google_android", "record": "CVE-2026-58936", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-02T20:00:00Z", "date_only": false, "value": "2026-11-02T20:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20261103", "record": "CVE-2026-58936", "field": "creation_timestamp", "uuid": "e419e3c7-8325-4d88-82e8-16d38172fb01", "url": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20261103"}, {"timestamp": "2026-11-02T20:00:00Z", "date_only": false, "value": "2026-11-02T20:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20261103", "record": "CVE-2026-58936", "field": "creation_timestamp", "uuid": "d5480223-317a-4ff4-9639-d58d0a446714", "url": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20261103"}, {"timestamp": "2026-11-02T20:17:50Z", "date_only": false, "value": "2026-11-02T20:17:50Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4VMQ-XGP9-J3PX", "record": "GHSA-4VMQ-XGP9-J3PX", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-02T20:17:50.837Z", "date_only": false, "value": "2026-11-02T20:17:50.837", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58936", "record": "FKIE_CVE-2026-58936", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T21:20:08.610Z", "date_only": false, "value": "2026-11-02T21:20:08.610066Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117548772220090104", "record": "CVE-2026-58936", "field": "creation_timestamp", "uuid": "1edea4a2-7c52-4a42-89a1-4006b763dd05", "content": "CVE-2026-58936  In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.\nhttps://www.cve.org/CVERecord?id=CVE-2026-58936https://source.android.com/docs/security/bulletin/2026/2026-11-01#Google #Android#CVE_2026_58936#bot", "url": "https://infosec.exchange/users/cve/statuses/117548772220090104"}, {"timestamp": "2026-11-02T21:32:02Z", "date_only": false, "value": "2026-11-02T21:32:02Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4VMQ-XGP9-J3PX", "record": "GHSA-4VMQ-XGP9-J3PX", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4288", "record": "WID-SEC-W-2026-4288", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4288", "record": "WID-SEC-W-2026-4288", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4288", "record": "WID-SEC-W-2026-4288", "field": "vulnerabilities.142.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1443", "record": "CERTFR-2026-AVI-1443", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1443", "record": "CERTFR-2026-AVI-1443", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1443", "record": "CERTFR-2026-AVI-1443", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-11-03T01:46:31.160Z", "date_only": false, "value": "2026-11-03T01:46:31.160335Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mzeprbbnp72f", "record": "CVE-2026-58936", "field": "creation_timestamp", "uuid": "11676625-7377-49eb-a82a-b5e3f1dccbd9", "content": "The November 2026 Android security update fixes 216 flaws, including zero-click remote code execution bugs CVE-2026-58868 and CVE-2026-58936.\n\n#Android #AndroidSecurity #CVE202658868 #ZeroClick #RCE #MediaTek #PatchNow #MobileSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mzeprbbnp72f"}, {"timestamp": "2026-11-03T21:00:00Z", "date_only": false, "value": "2026-11-03T21:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2159", "record": "CVE-2026-58936", "field": "creation_timestamp", "uuid": "13c3df18-9b74-45de-992f-961909d24f75", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2159"}, {"timestamp": "2026-11-03T22:47:56.123Z", "date_only": false, "value": "2026-11-03T22:47:56.123195Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mzgwasb5z22e", "record": "CVE-2026-58936", "field": "creation_timestamp", "uuid": "229a1335-f6bd-4728-bdca-7fcc8a26eb65", "content": "Android\u300111\u6708\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u3067216\u4ef6\u3092\u4fee\u6b63\u300023\u4ef6\u304cCritical\u3001\u64cd\u4f5c\u4e0d\u8981\u306e\u9060\u9694\u30b3\u30fc\u30c9\u5b9f\u884c\u8106\u5f31\u6027\u3082(CVE-2026-58868\u3001CVE-2026-58876\u3001CVE-2026-58936\u3001CVE-2026-58882) \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mzgwasb5z22e"}, {"timestamp": "2026-11-03T23:00:00Z", "date_only": false, "value": "2026-11-03T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4288", "record": "WID-SEC-W-2026-4288", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-04T04:55:57.793Z", "date_only": false, "value": "2026-11-04T04:55:57.793980Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-58936", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-11-04T04:55:57.793Z", "date_only": false, "value": "2026-11-04T04:55:57.793980Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58936", "record": "FKIE_CVE-2026-58936", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-04T13:32:45.155Z", "date_only": false, "value": "2026-11-04T13:32:45.155Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-58936", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-04T13:32:45.155Z", "date_only": false, "value": "2026-11-04T13:32:45.155Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-58936", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T14:50:03.949Z", "date_only": false, "value": "2026-11-04T14:50:03.949914Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzilzavsh72v", "record": "CVE-2026-58936", "field": "creation_timestamp", "uuid": "9516a727-3621-49e4-8041-c32ea001d9a5", "content": "CVE-2026-58936 - android\nAndroid's built\u2011in support for PNG images can mishandle certain files, causing memory corruption that lets an attacker run code on the device without any user interaction. This could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#android #google #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzilzavsh72v"}, {"timestamp": "2026-11-04T15:32:23Z", "date_only": false, "value": "2026-11-04T15:32:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4VMQ-XGP9-J3PX", "record": "GHSA-4VMQ-XGP9-J3PX", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T12:26:42.414Z", "date_only": false, "value": "2026-11-05T12:26:42.414881Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0467", "record": "NCSC-2026-0467", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-05T12:26:42.414Z", "date_only": false, "value": "2026-11-05T12:26:42.414881Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0467", "record": "NCSC-2026-0467", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T12:26:42.414Z", "date_only": false, "value": "2026-11-05T12:26:42.414881Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0467", "record": "NCSC-2026-0467", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-08T18:21:57.705Z", "date_only": false, "value": "2026-11-08T18:21:57.705860Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/bvqwr3no5bfko", "record": "CVE-2026-58936", "field": "creation_timestamp", "uuid": "3fa0863d-8ad8-48d7-9dac-9ca5aa89022c", "content": "\ud83d\udea8 CVE-2026-58936\nCVSS 9.8 / EPSS 0.31% / KEV: No\nTL;DR: In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution\u2026\nhttps://cvesentinel.com/report/CVE-2026-58936\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/bvqwr3no5bfko"}, {"timestamp": "2026-11-09T14:37:54.733Z", "date_only": false, "value": "2026-11-09T14:37:54.733", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58936", "record": "FKIE_CVE-2026-58936", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4288", "record": "WID-SEC-W-2026-4288", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4288", "record": "WID-SEC-W-2026-4288", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-11T11:32:31.459Z", "date_only": false, "value": "2026-11-11T11:32:31.459+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4288", "record": "WID-SEC-W-2026-4288", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-14T02:16:37.049Z", "anchors": {"origin": {"timestamp": "2026-11-02T19:54:09.925Z", "date_only": false, "value": "2026-11-02T19:54:09.925Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58936", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-02T19:54:09.925Z", "date_only": false, "value": "2026-11-02T19:54:09.925Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58936", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 973347.124587, "hours": 270.3742012741667, "days": 11.265591719756944, "min_seconds": 973347.124587, "max_seconds": 973347.124587, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-02T19:54:09.925Z", "date_only": false, "value": "2026-11-02T19:54:09.925Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58936", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T02:16:37.049Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}