{"id":"CVE-2026-56897","kind":"vulnerability","aliases":["CVE-2026-56897"],"related":[],"title":"Secure element firmware leaks uninitialized stack memory through attestation certificates","description":"In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestation certificates due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"Several functions in attestation_object.c can place uninitialized secure element stack memory into key attestation certificates. A local attacker can read that leftover memory without extra privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","attestation","other","secure-element"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:14+00:00","first_seen_at":"2026-11-10T20:46:06+00:00","triaged_at":"2026-11-10T20:53:58+00:00","updated_at":"2026-11-10T20:53:58+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T20:53:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Secure element firmware leaks uninitialized stack memory through attestation certificates","impact":"low","summary":"Several functions in attestation_object.c can place uninitialized secure element stack memory into key attestation certificates. A local attacker can read that leftover memory without extra privileges.","audience":"everyone","category":"other","nicknames":[],"who_cares":["secure-element","android","attestation"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"local attacker reads uninitialized secure element stack memory","analyst_note":"Identify the affected device or firmware vendor and check the NVD entry and vendor bulletin for the fixed build; the sources give no product or version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000635,"input_tokens":4533,"output_tokens":363,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-56897':13A,16A 'addit':85C 'android':17B 'attack':41B 'attest':9A,18B,26B,37B,54C,70C 'certif':10A,38B,71C 'could':77C 'cve':11A,14A 'data':75C 'disclos':62C 'disclosur':82C 'due':72C 'element':2A,22B,32B,65C 'execut':86C 'exploit':95C 'extra':48B 'firmwar':3A 'function':24B,52C 'inform':81C 'interact':90C 'key':36B,69C 'lead':78C 'leak':4A 'leftov':45B 'local':40B,80C 'memori':7A,34B,46B,67C 'multipl':51C 'need':88C,93C 'object.c':27B,55C 'place':29B 'possibl':59C 'privileg':49B,87C 'read':43B 'secur':1A,21B,31B,64C 'secure-el':20B 'sever':23B 'stack':6A,33B,66C 'uniniti':5A,30B,63C,74C 'user':89C 'way':60C 'without':47B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","attestation","other","secureelement","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-56897':13A,16A 'attest':9A 'certif':10A 'cve':11A,14A 'element':2A 'firmwar':3A 'leak':4A 'memori':7A 'secur':1A 'stack':6A 'uniniti':5A","search_b":"'android':17B 'attack':41B 'attest':18B,26B,37B 'certif':38B 'element':22B,32B 'extra':48B 'function':24B 'key':36B 'leftov':45B 'local':40B 'memori':34B,46B 'object.c':27B 'place':29B 'privileg':49B 'read':43B 'secur':21B,31B 'secure-el':20B 'sever':23B 'stack':33B 'uniniti':30B 'without':47B","search_c":"'addit':85C 'attest':54C,70C 'certif':71C 'could':77C 'data':75C 'disclos':62C 'disclosur':82C 'due':72C 'element':65C 'execut':86C 'exploit':95C 'function':52C 'inform':81C 'interact':90C 'key':69C 'lead':78C 'local':80C 'memori':67C 'multipl':51C 'need':88C,93C 'object.c':55C 'possibl':59C 'privileg':87C 'secur':64C 'stack':66C 'uniniti':63C,74C 'user':89C 'way':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56897","severity":null,"published_at":"2026-11-10T20:19:14+00:00","modified_at":"2026-11-10T20:19:14+00:00","first_seen_at":"2026-11-10T20:46:06+00:00","fetched_at":"2026-11-10T20:46:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}