---
id: "CVE-2026-20553"
kind: "vulnerability"
aliases: ["CVE-2026-20553"]
title: "DA: out-of-bounds write lets a device attacker gain higher privileges"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "infrastructure", "mobile-device"]
not_affected_if: ["no-physical-access"]
published_at: "2026-11-02T03:17:32+00:00"
first_seen_at: "2026-11-02T03:31:24+00:00"
updated_at: "2026-11-02T03:32:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20553", "first_seen_at": "2026-11-02T03:31:24+00:00"}]
---

# DA: out-of-bounds write lets a device attacker gain higher privileges

A missing bounds check in a component named DA allows an out-of-bounds write. An attacker with physical access to the device can escalate privileges locally, without extra execution rights or user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T03:31:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-20553

## From the sources

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11468968; Issue ID: MSV-10166.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_