# CVE-2026-58705: Google Pixel firmware out-of-bounds heap write in gscan

Source: https://junglewise.ai/threats/cve-2026-58705-in-handleevent-of-gscan-cpp-there-is-a-possible-way-to-trigger-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-58705 · Severity: info · Published 2026-11-10

Google Pixel devices contain a buffer overflow vulnerability in wireless scanning code that allows attackers to write beyond allocated heap memory without requiring authentication or user interaction. Exploiting this flaw could allow an attacker to escalate privileges on the device and take complete control of affected Pixel phones.

Technologies: [Google Pixel Firmware](https://junglewise.ai/threats/technologies/pixel-firmware). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-58705 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58705 being exploited in the wild.

**How severe is CVE-2026-58705?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Google Pixel firmware.

**Is there a fix for CVE-2026-58705?** Yes: fixed in November 2026 security patch level 2026-11-05 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58705 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-58705?** Check whether you run Google Pixel Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in November 2026 security patch level 2026-11-05 or later

## Technical details

An out-of-bounds write exists in handleEvent of gscan.cpp due to missing bounds checking on heap operations. The vulnerability requires no additional execution privileges and no user interaction to exploit, making it a remote privilege escalation vector. Patches are available in the November 2026 security updates (2026-11-05 patch level or later).

## Affected products

- Google Pixel firmware

## Timeline

- 2026-11-10: disclosed

## References

- [https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01](https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01)

## Related threats

- [Google Pixel firmware heap buffer overflow in CLDMA audio processing](https://junglewise.ai/threats/cve-2026-59601-in-calculatesamplerate-of-cldma-alcedo-cc-there-is-a-possible)
- [Google Pixel firmware out-of-bounds write in NCI command handler](https://junglewise.ai/threats/cve-2026-59587-in-stpropnci-prop-st-build-set-custom-polling-cmd-of-stpropnci)
- [Google Pixel firmware out of bounds read/write in log formatting](https://junglewise.ai/threats/cve-2026-59574-in-notifypollingloopframes-of-hal-fwlog-cc-there-is-a-possible)
- [Google Pixel firmware information disclosure on warm reset](https://junglewise.ai/threats/cve-2026-58808-in-multiple-locations-there-is-a-possible-way-to-dump-secure)
- [Google Pixel firmware memory bounds check in secure boot](https://junglewise.ai/threats/cve-2026-58805-in-multiple-locations-there-is-a-possible-way-to-zero-arbitrary)