{"id":"CVE-2026-56884","kind":"vulnerability","aliases":["CVE-2026-56884"],"related":[],"title":"Android Trusty: unvalidated parameters let a local process escalate privileges","description":"In ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalidated parameters due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","summary":"A flaw in the ac_set_ns_ipa_tbl function of plat_trusty.c lets unvalidated input corrupt stream table entry configurations. The sources say an attacker who already runs locally with System privileges can escalate privileges, with no user interaction needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mobile-devices","trusty"],"not_affected_if":["no-local-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:14+00:00","first_seen_at":"2026-11-10T20:46:06+00:00","triaged_at":"2026-11-10T20:53:57+00:00","updated_at":"2026-11-10T20:53:57+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:53:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android Trusty: unvalidated parameters let a local process escalate privileges","impact":"high","summary":"A flaw in the ac_set_ns_ipa_tbl function of plat_trusty.c lets unvalidated input corrupt stream table entry configurations. The sources say an attacker who already runs locally with System privileges can escalate privileges, with no user interaction needed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","trusty","mobile-devices"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local System-level process gains higher privileges on the device","analyst_note":"Confirm affected Android security bulletin versions and the vendor patch level from the NVD record or the Android Security Bulletin.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-access"],"who_is_affected":"The sources do not name affected product versions or the exact device families. The flaw is in a platform driver component and needs a local attacker already running with System privileges, so it is mainly a concern for device vendors and fleet owners.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":4554,"output_tokens":448,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-56884':13A,16A 'ac':27B,65C 'alreadi':50B 'android':1A,17B 'attack':48B 'configur':43B,83C 'corrupt':39B,79C 'could':93C 'cve':11A,14A 'devic':21B 'due':87C 'entri':42B,82C 'escal':9A,57B,97C 'execut':102C 'exploit':111C 'flaw':24B 'function':32B 'improp':89C 'infrastructur':18B 'input':38B,90C 'interact':62B,106C 'ipa':30B,68C 'lead':94C 'let':5A,36B 'local':7A,52B,96C 'mobil':20B 'mobile-devic':19B 'need':63B,104C,109C 'ns':29B,67C 'paramet':4A,86C 'plat':34B,71C 'possibl':76C 'privileg':10A,55B,58B,99C,103C 'process':8A 'run':51B 'say':46B 'set':28B,66C 'sourc':45B 'stream':40B,80C 'system':54B,101C 'tabl':41B,81C 'tbl':31B,69C 'trusti':2A,22B 'trusty.c':35B,72C 'unvalid':3A,37B,85C 'user':61B,105C 'valid':91C 'via':84C 'way':77C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name affected product versions or the exact device families. The flaw is in a platform driver component and needs a local attacker already running with System privileges, so it is mainly a concern for device vendors and fleet owners.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","mobiledevices","trusty","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-56884':13A,16A 'android':1A 'cve':11A,14A 'escal':9A 'let':5A 'local':7A 'paramet':4A 'privileg':10A 'process':8A 'trusti':2A 'unvalid':3A","search_b":"'ac':27B 'alreadi':50B 'android':17B 'attack':48B 'configur':43B 'corrupt':39B 'devic':21B 'entri':42B 'escal':57B 'flaw':24B 'function':32B 'infrastructur':18B 'input':38B 'interact':62B 'ipa':30B 'let':36B 'local':52B 'mobil':20B 'mobile-devic':19B 'need':63B 'ns':29B 'plat':34B 'privileg':55B,58B 'run':51B 'say':46B 'set':28B 'sourc':45B 'stream':40B 'system':54B 'tabl':41B 'tbl':31B 'trusti':22B 'trusty.c':35B 'unvalid':37B 'user':61B","search_c":"'ac':65C 'configur':83C 'corrupt':79C 'could':93C 'due':87C 'entri':82C 'escal':97C 'execut':102C 'exploit':111C 'improp':89C 'input':90C 'interact':106C 'ipa':68C 'lead':94C 'local':96C 'need':104C,109C 'ns':67C 'paramet':86C 'plat':71C 'possibl':76C 'privileg':99C,103C 'set':66C 'stream':80C 'system':101C 'tabl':81C 'tbl':69C 'trusty.c':72C 'unvalid':85C 'user':105C 'valid':91C 'via':84C 'way':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56884","severity":null,"published_at":"2026-11-10T20:19:14+00:00","modified_at":"2026-11-10T20:19:14+00:00","first_seen_at":"2026-11-10T20:46:06+00:00","fetched_at":"2026-11-10T20:46:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}