{"id":"CVE-2026-55312","kind":"vulnerability","aliases":["CVE-2026-55312"],"related":[],"title":"Android kernel remap.c: out-of-bounds write lets a local app gain system privileges","description":"In insert_node of remap.c, there is a possible way to trigger an out of bounds write in the address remapping table due to a non-heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","summary":"An out-of-bounds write in the address remapping table code in remap.c can be triggered by a local process. An attacker who already runs code with System privileges can use it to escalate further.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","kernel"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:13+00:00","first_seen_at":"2026-11-10T20:46:05+00:00","triaged_at":"2026-11-10T20:54:04+00:00","updated_at":"2026-11-10T20:54:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:54:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android kernel remap.c: out-of-bounds write lets a local app gain system privileges","impact":"high","summary":"An out-of-bounds write in the address remapping table code in remap.c can be triggered by a local process. An attacker who already runs code with System privileges can use it to escalate further.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","kernel"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local code gains System-level privileges on the device","analyst_note":"Confirm the affected product and patch level from the NVD entry and the Android security bulletin for the month this CVE was published.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000622,"input_tokens":4530,"output_tokens":337,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-55312':18A,21A 'address':33B,79C 'alreadi':49B 'android':1A,22B 'app':12A 'attack':47B 'bound':7A,29B,75C 'buffer':88C 'code':36B,51B 'could':91C 'cve':16A,19A 'due':82C 'escal':59B,95C 'execut':100C 'exploit':109C 'gain':13A 'heap':87C 'infrastructur':23B 'insert':61C 'interact':104C 'kernel':2A,24B 'lead':92C 'let':9A 'local':11A,44B,94C 'need':102C,107C 'node':62C 'non':86C 'non-heap':85C 'out-of-bound':4A,26B 'overflow':89C 'possibl':68C 'privileg':15A,54B,97C,101C 'process':45B 'remap':34B,80C 'remap.c':3A,38B,64C 'run':50B 'system':14A,53B,99C 'tabl':35B,81C 'trigger':41B,71C 'use':56B 'user':103C 'way':69C 'write':8A,30B,76C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","kernel","unknown"],"campaign_type":null,"search_a":"'-2026':17A,20A '-55312':18A,21A 'android':1A 'app':12A 'bound':7A 'cve':16A,19A 'gain':13A 'kernel':2A 'let':9A 'local':11A 'out-of-bound':4A 'privileg':15A 'remap.c':3A 'system':14A 'write':8A","search_b":"'address':33B 'alreadi':49B 'android':22B 'attack':47B 'bound':29B 'code':36B,51B 'escal':59B 'infrastructur':23B 'kernel':24B 'local':44B 'out-of-bound':26B 'privileg':54B 'process':45B 'remap':34B 'remap.c':38B 'run':50B 'system':53B 'tabl':35B 'trigger':41B 'use':56B 'write':30B","search_c":"'address':79C 'bound':75C 'buffer':88C 'could':91C 'due':82C 'escal':95C 'execut':100C 'exploit':109C 'heap':87C 'insert':61C 'interact':104C 'lead':92C 'local':94C 'need':102C,107C 'node':62C 'non':86C 'non-heap':85C 'overflow':89C 'possibl':68C 'privileg':97C,101C 'remap':80C 'remap.c':64C 'system':99C 'tabl':81C 'trigger':71C 'user':103C 'way':69C 'write':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55312","severity":null,"published_at":"2026-11-10T20:19:13+00:00","modified_at":"2026-11-10T20:19:13+00:00","first_seen_at":"2026-11-10T20:46:05+00:00","fetched_at":"2026-11-10T20:46:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}