{"id":"CVE-2026-56911","kind":"vulnerability","aliases":["CVE-2026-56911"],"related":[],"title":"Android: missing bounds check in FIPS HMAC handler allows local privilege escalation","description":"In handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","summary":"A heap buffer overflow in the hwcrypto proxy's FIPS HMAC request handler lacks a bounds check. A local app with system-level execution could use it to escalate privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","local-privilege-escalation"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:15+00:00","first_seen_at":"2026-11-10T20:46:06+00:00","triaged_at":"2026-11-10T20:53:51+00:00","updated_at":"2026-11-10T20:53:51+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:53:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: missing bounds check in FIPS HMAC handler allows local privilege escalation","impact":"high","summary":"A heap buffer overflow in the hwcrypto proxy's FIPS HMAC request handler lacks a bounds check. A local app with system-level execution could use it to escalate privileges.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","local-privilege-escalation"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"local code escalates to system-level privileges on the device","analyst_note":"Identify the affected Android or vendor builds and the patch level that fixes hwcrypto_proxy.c from the NVD entry and the vendor bulletin.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources name no product or version, only the file hwcrypto_proxy.c and the handle_fips_hmac_req function. The flaw is local and needs system-level execution, so it matters on devices where that code runs. unknown for the affected builds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":4540,"output_tokens":453,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-56911':15A,18A 'allow':9A 'android':1A,19B 'app':44B 'bound':3A,40B,74C 'buffer':27B,69C 'check':4A,41B,75C 'could':50B,77C 'cve':13A,16A 'due':71C 'escal':12A,24B,54B,81C 'execut':49B,86C 'exploit':95C 'fip':6A,34B,58C 'handl':57C 'handler':8A,37B 'heap':26B,68C 'hmac':7A,35B,59C 'hwcrypto':31B,62C 'infrastructur':20B 'interact':90C 'lack':38B 'lead':78C 'level':48B 'local':10A,22B,43B,80C 'local-privilege-escal':21B 'miss':2A,73C 'need':88C,93C 'overflow':28B,70C 'possibl':67C 'privileg':11A,23B,55B,83C,87C 'proxi':32B 'proxy.c':63C 'req':60C 'request':36B 'system':47B,85C 'system-level':46B 'use':51B 'user':89C","nicknames":[],"mitigations":[],"who_affected":"The sources name no product or version, only the file hwcrypto_proxy.c and the handle_fips_hmac_req function. The flaw is local and needs system-level execution, so it matters on devices where that code runs. unknown for the affected builds.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","localprivilegeescalation","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-56911':15A,18A 'allow':9A 'android':1A 'bound':3A 'check':4A 'cve':13A,16A 'escal':12A 'fip':6A 'handler':8A 'hmac':7A 'local':10A 'miss':2A 'privileg':11A","search_b":"'android':19B 'app':44B 'bound':40B 'buffer':27B 'check':41B 'could':50B 'escal':24B,54B 'execut':49B 'fip':34B 'handler':37B 'heap':26B 'hmac':35B 'hwcrypto':31B 'infrastructur':20B 'lack':38B 'level':48B 'local':22B,43B 'local-privilege-escal':21B 'overflow':28B 'privileg':23B,55B 'proxi':32B 'request':36B 'system':47B 'system-level':46B 'use':51B","search_c":"'bound':74C 'buffer':69C 'check':75C 'could':77C 'due':71C 'escal':81C 'execut':86C 'exploit':95C 'fip':58C 'handl':57C 'heap':68C 'hmac':59C 'hwcrypto':62C 'interact':90C 'lead':78C 'local':80C 'miss':73C 'need':88C,93C 'overflow':70C 'possibl':67C 'privileg':83C,87C 'proxy.c':63C 'req':60C 'system':85C 'user':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56911","severity":null,"published_at":"2026-11-10T20:19:15+00:00","modified_at":"2026-11-10T20:19:15+00:00","first_seen_at":"2026-11-10T20:46:06+00:00","fetched_at":"2026-11-10T20:46:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}