{"id":"CVE-2026-20553","kind":"vulnerability","aliases":["CVE-2026-20553"],"related":[],"title":"DA: out-of-bounds write lets a device attacker gain higher privileges","description":"In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11468968; Issue ID: MSV-10166.","summary":"A missing bounds check in a component named DA allows an out-of-bounds write. An attacker with physical access to the device can escalate privileges locally, without extra execution rights or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mobile-device"],"not_affected_if":["no-physical-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T03:17:32+00:00","first_seen_at":"2026-11-02T03:31:24+00:00","triaged_at":"2026-11-02T03:32:39+00:00","updated_at":"2026-11-02T03:32:39+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-02T03:32:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"DA: out-of-bounds write lets a device attacker gain higher privileges","impact":"high","summary":"A missing bounds check in a component named DA allows an out-of-bounds write. An attacker with physical access to the device can escalate privileges locally, without extra execution rights or user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["mobile-device","android"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"local attacker with physical access escalates privileges on the device","analyst_note":"Identify which products ship the DA component and the patched build for Patch ID ALPS11468968 (MediaTek bulletin likely; check the vendor page linked from NVD).","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-physical-access"],"who_is_affected":"The sources do not name the affected device or vendor build, so the exposed product list is unknown. The description says exploitation needs physical access to the device and no user interaction.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000618,"input_tokens":4109,"output_tokens":415,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-10166':112C '-2026':15A,18A '-20553':16A,19A 'access':45B,89C 'addit':95C 'allow':34B 'alps11468968':108C 'android':20B 'attack':10A,42B,86C 'bound':5A,27B,39B,68C,74C 'check':28B,75C 'compon':31B 'could':77C 'cve':14A,17A 'da':1A,33B,61C 'devic':9A,24B,48B,92C 'due':70C 'escal':50B,81C 'execut':55B,96C 'exploit':105C 'extra':54B 'gain':11A 'higher':12A 'id':107C,110C 'infrastructur':21B 'interact':59B,100C 'issu':109C 'lead':78C 'let':7A 'local':52B,80C 'miss':26B,73C 'mobil':23B 'mobile-devic':22B 'msv':111C 'name':32B 'need':98C,103C 'out-of-bound':2A,36B 'patch':106C 'physic':44B,88C 'possibl':65C 'privileg':13A,51B,83C,97C 'right':56B 'user':58B,99C 'without':53B 'write':6A,40B,69C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected device or vendor build, so the exposed product list is unknown. The description says exploitation needs physical access to the device and no user interaction.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","mobiledevice","unknown"],"first_public_at":"2026-11-02T03:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20553","severity":null,"published_at":"2026-11-02T03:17:32+00:00","modified_at":"2026-11-02T03:17:32+00:00","first_seen_at":"2026-11-02T03:31:24+00:00","fetched_at":"2026-11-02T03:31:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}