{"id":"CVE-2026-57009","kind":"vulnerability","aliases":["CVE-2026-57009"],"related":[],"title":"GC2AvcDec video decoder logic error allows local privilege escalation","description":"In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.","summary":"A logic error in the GC2AvcDec component of GC2AvcDec.cpp can be abused to escalate privileges on the device. An attacker with local code execution could gain higher privileges, and exploitation requires user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","video-decoder"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:17+00:00","first_seen_at":"2026-11-10T20:46:08+00:00","triaged_at":"2026-11-10T20:52:13+00:00","updated_at":"2026-11-10T20:52:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:52:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"GC2AvcDec video decoder logic error allows local privilege escalation","impact":"high","summary":"A logic error in the GC2AvcDec component of GC2AvcDec.cpp can be abused to escalate privileges on the device. An attacker with local code execution could gain higher privileges, and exploitation requires user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","video-decoder"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local code gains elevated privileges on the device","analyst_note":"Confirm affected Android or vendor builds and the patched security bulletin version from the NVD entry and the vendor advisory.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000637,"input_tokens":4524,"output_tokens":369,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-57009':12A,15A 'abus':32B 'allow':6A 'android':16B 'attack':40B 'code':43B,71C 'compon':27B 'could':45B,73C 'cve':10A,13A 'decod':3A,20B 'devic':38B 'due':64C 'error':5A,23B,63C,68C 'escal':9A,34B,77C 'execut':44B,81C 'exploit':50B,88C 'gain':46B 'gc2avcdec':1A,26B,55C 'gc2avcdec.cpp':29B,57C 'higher':47B 'infrastructur':17B 'interact':53B,85C 'lead':74C 'local':7A,42B,76C 'logic':4A,22B,62C,67C 'need':83C 'possibl':61C 'privileg':8A,35B,48B,79C,82C 'requir':51B 'user':52B,84C 'video':2A,19B 'video-decod':18B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","unknown","videodecoder"],"campaign_type":null,"search_a":"'-2026':11A,14A '-57009':12A,15A 'allow':6A 'cve':10A,13A 'decod':3A 'error':5A 'escal':9A 'gc2avcdec':1A 'local':7A 'logic':4A 'privileg':8A 'video':2A","search_b":"'abus':32B 'android':16B 'attack':40B 'code':43B 'compon':27B 'could':45B 'decod':20B 'devic':38B 'error':23B 'escal':34B 'execut':44B 'exploit':50B 'gain':46B 'gc2avcdec':26B 'gc2avcdec.cpp':29B 'higher':47B 'infrastructur':17B 'interact':53B 'local':42B 'logic':22B 'privileg':35B,48B 'requir':51B 'user':52B 'video':19B 'video-decod':18B","search_c":"'code':71C 'could':73C 'due':64C 'error':63C,68C 'escal':77C 'execut':81C 'exploit':88C 'gc2avcdec':55C 'gc2avcdec.cpp':57C 'interact':85C 'lead':74C 'local':76C 'logic':62C,67C 'need':83C 'possibl':61C 'privileg':79C,82C 'user':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57009","severity":null,"published_at":"2026-11-10T20:19:17+00:00","modified_at":"2026-11-10T20:19:17+00:00","first_seen_at":"2026-11-10T20:46:08+00:00","fetched_at":"2026-11-10T20:46:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}