---
id: "CVE-2026-57005"
page: "https://infrastack.ai/live/CVE-2026-57005"
kind: "vulnerability"
aliases: ["CVE-2026-57005"]
title: "Android: EuiccPort confused deputy lets remote attacker escalate privilege"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "infrastructure"]
not_affected_if: []
published_at: "2026-11-10T20:19:17+00:00"
first_seen_at: "2026-11-10T20:46:08+00:00"
updated_at: "2026-11-10T20:52:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57005", "first_seen_at": "2026-11-10T20:46:08+00:00"}]
exploit_sources: []
---

# Android: EuiccPort confused deputy lets remote attacker escalate privilege

Link for people: https://infrastack.ai/live/CVE-2026-57005 (this .md is for agents)

A confused deputy flaw in the Android EuiccPort.buildUiccAccessRule code lets an app make the system act with rights it should not grant. The description says this can lead to remote privilege escalation, with user interaction needed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57005

## From the sources

In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. This could lead to remote escalation of privilege with execution privileges needed. User interaction is for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_