---
id: "CVE-2026-56884"
page: "https://infrastack.ai/live/CVE-2026-56884"
kind: "vulnerability"
aliases: ["CVE-2026-56884"]
title: "Android Trusty: unvalidated parameters let a local process escalate privileges"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "infrastructure", "mobile-devices", "trusty"]
not_affected_if: ["no-local-access"]
published_at: "2026-11-10T20:19:14+00:00"
first_seen_at: "2026-11-10T20:46:06+00:00"
updated_at: "2026-11-10T20:53:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56884", "first_seen_at": "2026-11-10T20:46:06+00:00"}]
exploit_sources: []
---

# Android Trusty: unvalidated parameters let a local process escalate privileges

Link for people: https://infrastack.ai/live/CVE-2026-56884 (this .md is for agents)

A flaw in the ac_set_ns_ipa_tbl function of plat_trusty.c lets unvalidated input corrupt stream table entry configurations. The sources say an attacker who already runs locally with System privileges can escalate privileges, with no user interaction needed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56884

## From the sources

In ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalidated parameters due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_