---
id: "CVE-2026-56897"
page: "https://infrastack.ai/live/CVE-2026-56897"
kind: "vulnerability"
aliases: ["CVE-2026-56897"]
title: "Secure element firmware leaks uninitialized stack memory through attestation certificates"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "attestation", "other", "secure-element"]
not_affected_if: []
published_at: "2026-11-10T20:19:14+00:00"
first_seen_at: "2026-11-10T20:46:06+00:00"
updated_at: "2026-11-10T20:53:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56897", "first_seen_at": "2026-11-10T20:46:06+00:00"}]
exploit_sources: []
---

# Secure element firmware leaks uninitialized stack memory through attestation certificates

Link for people: https://infrastack.ai/live/CVE-2026-56897 (this .md is for agents)

Several functions in attestation_object.c can place uninitialized secure element stack memory into key attestation certificates. A local attacker can read that leftover memory without extra privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56897

## From the sources

In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestation certificates due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_