{"id":"CVE-2026-20581","kind":"vulnerability","aliases":["CVE-2026-20581"],"related":[],"title":"Android USB driver: use-after-free lets a privileged process escalate further","description":"In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411985; Issue ID: MSV-9750.","summary":"A use-after-free bug in the USB code can corrupt memory. An attacker who already holds System-level privilege on the device could use it to escalate privilege locally.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mediatek","usb"],"not_affected_if":["no-system-privilege-attacker"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T03:17:35+00:00","first_seen_at":"2026-11-02T03:31:25+00:00","triaged_at":"2026-11-02T03:32:16+00:00","updated_at":"2026-11-02T03:32:16+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T03:32:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android USB driver: use-after-free lets a privileged process escalate further","impact":"medium","summary":"A use-after-free bug in the USB code can corrupt memory. An attacker who already holds System-level privilege on the device could use it to escalate privilege locally.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","usb","mediatek"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker with System privilege escalates to deeper kernel-level control","analyst_note":"Check the NVD entry and the Android security bulletin for affected builds and the patch level that includes Patch ID ALPS11411985.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-system-privilege-attacker"],"who_is_affected":"Only devices that run the affected USB code. Exploitation needs an attacker who already has System privilege, so an ordinary app or remote attacker cannot use it alone. unknown for the exact affected products and versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000621,"input_tokens":4091,"output_tokens":423,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-20581':15A,18A '-9750':99C 'actor':79C 'alps11411985':95C 'alreadi':39B,81C 'android':1A,19B 'attack':37B 'bug':28B 'code':32B 'corrupt':34B,62C 'could':48B,69C 'cve':13A,16A 'devic':47B 'driver':3A 'due':63C 'escal':12A,52B,73C 'exploit':92C 'free':7A,27B,67C 'hold':40B 'id':94C,97C 'infrastructur':20B 'interact':87C 'issu':96C 'lead':70C 'let':8A 'level':43B 'local':54B,72C 'malici':78C 'mediatek':21B 'memori':35B,61C 'msv':98C 'need':90C 'obtain':82C 'patch':93C 'possibl':60C 'privileg':10A,44B,53B,75C,85C 'process':11A 'system':42B,84C 'system-level':41B 'usb':2A,22B,31B,56C 'use':5A,25B,49B,65C 'use-after-fre':4A,24B 'user':86C","nicknames":[],"mitigations":[],"who_affected":"Only devices that run the affected USB code. Exploitation needs an attacker who already has System privilege, so an ordinary app or remote attacker cannot use it alone. unknown for the exact affected products and versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","mediatek","unknown","usb"],"first_public_at":"2026-11-02T03:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20581","severity":null,"published_at":"2026-11-02T03:17:35+00:00","modified_at":"2026-11-02T03:17:35+00:00","first_seen_at":"2026-11-02T03:31:25+00:00","fetched_at":"2026-11-02T03:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}