{"id":"CVE-2026-14447","kind":"vulnerability","aliases":["CVE-2026-14447"],"related":[],"title":"Android memss driver: off-by-one check leaks out-of-bounds physical addresses locally","description":"In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-by-one check due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.","summary":"An off-by-one bounds check in the memss-mfw.c driver's ext_mem_obj_get_page function can return a physical address outside the intended range. A local attacker with System-level execution privileges can read that information.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","kernel-driver"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:10+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","triaged_at":"2026-11-10T20:54:10+00:00","updated_at":"2026-11-10T20:54:10+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:54:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android memss driver: off-by-one check leaks out-of-bounds physical addresses locally","impact":"low","summary":"An off-by-one bounds check in the memss-mfw.c driver's ext_mem_obj_get_page function can return a physical address outside the intended range. A local attacker with System-level execution privileges can read that information.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","kernel-driver"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker reads out-of-bounds physical memory addresses","analyst_note":"Identify the affected Android/vendor build and patch level from the NVD entry and the Android security bulletin; the sources give no product ranges or fixed version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000649,"input_tokens":4546,"output_tokens":388,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-14447':19A,22A '-2026':18A,21A 'address':15A,53B,94C 'android':1A,23B 'attack':60B 'bound':13A,33B,92C,106C 'c':40B,81C 'check':8A,34B,101C,107C 'could':109C 'cve':17A,20A 'disclosur':114C 'driver':3A,27B,41B 'due':102C 'execut':65B,117C 'exploit':126C 'ext':43B,72C 'function':48B 'get':46B,75C 'incorrect':105C 'inform':70B,113C 'infrastructur':24B 'intend':56B 'interact':121C 'kernel':26B 'kernel-driv':25B 'lead':110C 'leak':9A 'level':64B 'local':16A,59B,112C 'mem':44B,73C 'memss':2A,38B,79C 'memss-mfw':37B,78C 'mfw':39B,80C 'need':119C,124C 'obj':45B,74C 'off-by-on':4A,29B,97C 'one':7A,32B,100C 'out-of-bound':10A 'outsid':54B 'page':47B,76C 'physic':14A,52B,93C 'possibl':85C 'privileg':66B,118C 'rang':57B 'read':68B 'return':50B,88C 'system':63B,116C 'system-level':62B 'user':120C 'via':95C 'way':86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","kerneldriver","unknown"],"campaign_type":null,"search_a":"'-14447':19A,22A '-2026':18A,21A 'address':15A 'android':1A 'bound':13A 'check':8A 'cve':17A,20A 'driver':3A 'leak':9A 'local':16A 'memss':2A 'off-by-on':4A 'one':7A 'out-of-bound':10A 'physic':14A","search_b":"'address':53B 'android':23B 'attack':60B 'bound':33B 'c':40B 'check':34B 'driver':27B,41B 'execut':65B 'ext':43B 'function':48B 'get':46B 'inform':70B 'infrastructur':24B 'intend':56B 'kernel':26B 'kernel-driv':25B 'level':64B 'local':59B 'mem':44B 'memss':38B 'memss-mfw':37B 'mfw':39B 'obj':45B 'off-by-on':29B 'one':32B 'outsid':54B 'page':47B 'physic':52B 'privileg':66B 'rang':57B 'read':68B 'return':50B 'system':63B 'system-level':62B","search_c":"'address':94C 'bound':92C,106C 'c':81C 'check':101C,107C 'could':109C 'disclosur':114C 'due':102C 'execut':117C 'exploit':126C 'ext':72C 'get':75C 'incorrect':105C 'inform':113C 'interact':121C 'lead':110C 'local':112C 'mem':73C 'memss':79C 'memss-mfw':78C 'mfw':80C 'need':119C,124C 'obj':74C 'off-by-on':97C 'one':100C 'page':76C 'physic':93C 'possibl':85C 'privileg':118C 'return':88C 'system':116C 'user':120C 'via':95C 'way':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14447","severity":null,"published_at":"2026-11-10T20:19:10+00:00","modified_at":"2026-11-10T20:19:10+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","fetched_at":"2026-11-10T20:46:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}