External risk intelligence

IMG vkCreateImageView Use After Free Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-58800

The vulnerability exists within low-level graphics/image processing components (IMG_vkCreateImageView) typically utilized by client-side applications, libraries, or device drivers. These components operate locally within the user environment and are not designed to be exposed directly to the public internet as network services, gateways, or public-facing endpoints.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in image processing software that could allow an attacker to execute malicious code remotely without any user interaction. This issue impacts systems that utilize the affected graphics components, potentially leading to a compromise of the device.

A memory flaw can let attackers run code remotely.
It impacts graphics software, a common system component.
Assess systems for exposure and potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by interacting with an application or system that utilizes the vulnerable image processing component, likely through network-accessible services or by tricking a user into processing a specially crafted input. This could lead to memory corruption and potentially remote code execution without requiring elevated privileges.

Entry condition: Network or local access.
Trigger point: Vulnerable image processing function.
Resulting risk: Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary code on a system without any user interaction. This is possible due to a use-after-free condition in the image view creation process that can lead to memory corruption.

Arbitrary code execution.
Memory corruption allows exploitation.
System compromise without privileges.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in image processing components, likely impacting application or platform teams. The first actionable step is to identify all instances of the affected technology, determine their business criticality and network reachability, and then assign ownership for remediation planning.

Application or platform teams own remediation.
Verify affected technology instances and reachability.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IMG_vkCreateImageView and how is it used?

This component is part of the Vulkan graphics API stack, which developers use to render high-performance images and complex visuals on devices. It handles the low-level tasks of creating image views, essentially defining how an application accesses and interprets graphics memory. It is a fundamental piece of system software found in various client-side applications and device drivers.

What does CWE-416 mean for CVE-2026-58800?

CWE-416 refers to a Use After Free vulnerability. In plain terms, this happens when software continues to use a piece of memory after it has been cleared or released. Because the program might try to access that memory location again while it holds new or different data, an attacker can corrupt the system's memory to trick it into executing unintended, potentially malicious commands.

How does an attacker trigger this use-after-free bug?

The flaw is triggered during the image view creation process within the graphics component. It does not require user interaction or elevated permissions to occur. It is important to note that simply viewing a standard, benign image does not trigger the bug; the system must process a specially crafted input designed to exploit the memory corruption vulnerability at the exact moment the function attempts to manage that freed memory.

Is my system at risk for CVE-2026-58800?

According to Halo Surface Signal, this vulnerability is very unlikely to be reachable over the internet. Because the affected graphics components are designed for local processing within client-side applications and drivers, they are not typically exposed as public network services or gateways. The risk is significantly lower for systems not directly performing untrusted image processing tasks.

What are the first steps to address this vulnerability?

Begin by identifying all applications or platforms in your environment that utilize the affected graphics component. Since these are often embedded in larger software packages, consult with your development or platform teams to confirm if your specific versions are impacted. Once identified, prioritize these systems based on their business criticality and whether they interact with external, untrusted data sources.

References

source.android.com/docs/security/bulletin/pixel/2026/2026-11-01

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.