{"id":"CVE-2026-20576","kind":"vulnerability","aliases":["CVE-2026-20576"],"related":[],"title":"Android AFE component: out-of-bounds write lets a local app escalate privilege","description":"In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431385; Issue ID: MSV-9920.","summary":"The afe component has a missing bounds check that allows an out-of-bounds write. An attacker who already holds System privilege can use it to escalate privileges locally, and no user interaction is needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mediatek"],"not_affected_if":["no-system-compromise"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T03:17:35+00:00","first_seen_at":"2026-11-02T03:31:25+00:00","triaged_at":"2026-11-02T03:32:19+00:00","updated_at":"2026-11-02T03:32:19+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-02T03:32:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android AFE component: out-of-bounds write lets a local app escalate privilege","impact":"high","summary":"The afe component has a missing bounds check that allows an out-of-bounds write. An attacker who already holds System privilege can use it to escalate privileges locally, and no user interaction is needed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","mediatek"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker with System privilege gains higher local privilege on the device.","analyst_note":"Confirm which Android or MediaTek products ship the afe component and the patched build for patch ID ALPS11431385 (NVD entry linked in sources).","how_to_check":"unknown","plain_action":"unknown","needs_analyst":true,"not_affected_if":["no-system-compromise"],"who_is_affected":"The sources name only the afe component and a patch ID (ALPS11431385); they do not give affected product versions or devices. Exploitation requires an attacker who already has System privilege, so the risk is limited to a compromised device.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000629,"input_tokens":4101,"output_tokens":437,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-20576':17A,20A '-9920':107C 'actor':87C 'afe':2A,25B,61C 'allow':33B 'alps11431385':103C 'alreadi':43B,89C 'android':1A,21B 'app':12A 'attack':41B 'bound':7A,30B,38B,68C,74C 'check':31B,75C 'compon':3A,26B 'could':77C 'cve':15A,18A 'due':70C 'escal':13A,51B,81C 'exploit':100C 'hold':44B 'id':102C,105C 'infrastructur':22B 'interact':57B,95C 'issu':104C 'lead':78C 'let':9A 'local':11A,53B,80C 'malici':86C 'mediatek':23B 'miss':29B,73C 'msv':106C 'need':59B,98C 'obtain':90C 'out-of-bound':4A,35B 'patch':101C 'possibl':65C 'privileg':14A,46B,52B,83C,93C 'system':45B,92C 'use':48B 'user':56B,94C 'write':8A,39B,69C","nicknames":[],"mitigations":[],"who_affected":"The sources name only the afe component and a patch ID (ALPS11431385); they do not give affected product versions or devices. Exploitation requires an attacker who already has System privilege, so the risk is limited to a compromised device.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","mediatek","unknown"],"first_public_at":"2026-11-02T03:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20576","severity":null,"published_at":"2026-11-02T03:17:35+00:00","modified_at":"2026-11-02T03:17:35+00:00","first_seen_at":"2026-11-02T03:31:25+00:00","fetched_at":"2026-11-02T03:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}