{"id":"CVE-2026-58804","kind":"vulnerability","aliases":["CVE-2026-58804"],"related":[],"title":"Android graphics component: out-of-bounds write lets local apps gain privileges","description":"In ExecuteGraphCommand of multiple files, there is a possible way to trigger an out of bounds write via an oversized scratch memory declaration due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A bounds-check error in the ExecuteGraphCommand routine of the multiple-files component allows an oversized scratch memory declaration to write outside its buffer. A local attacker can use this to escalate privileges without extra execution rights or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","local-privilege-escalation"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:27+00:00","first_seen_at":"2026-11-10T20:46:11+00:00","triaged_at":"2026-11-10T20:51:32+00:00","updated_at":"2026-11-10T20:51:32+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:51:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android graphics component: out-of-bounds write lets local apps gain privileges","impact":"high","summary":"A bounds-check error in the ExecuteGraphCommand routine of the multiple-files component allows an oversized scratch memory declaration to write outside its buffer. A local attacker can use this to escalate privileges without extra execution rights or user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","local-privilege-escalation"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"local code gains elevated privileges on the device","analyst_note":"Identify the affected product and vendor bulletin from the NVD entry and confirm the fixed build; sources give no products or ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The sources do not name the affected product or version range, only that the flaw sits in ExecuteGraphCommand in a multiple-files component. Exposure depends on whether a local process can reach that code path, which the sources do not say.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4548,"output_tokens":437,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-58804':16A,19A 'addit':107C 'allow':41B 'android':1A,20B 'app':11A 'attack':54B 'bound':7A,28B,83C,95C 'bounds-check':27B 'buffer':51B 'check':29B,96C 'compon':3A,40B 'could':98C 'cve':14A,17A 'declar':46B,90C 'due':91C 'error':30B 'escal':25B,59B,102C 'execut':63B,108C 'executegraphcommand':33B,69C 'exploit':117C 'extra':62B 'file':39B,72C 'gain':12A 'graphic':2A 'incorrect':94C 'infrastructur':21B 'interact':67B,112C 'lead':99C 'let':9A 'local':10A,23B,53B,101C 'local-privilege-escal':22B 'memori':45B,89C 'multipl':38B,71C 'multiple-fil':37B 'need':110C,115C 'out-of-bound':4A 'outsid':49B 'overs':43B,87C 'possibl':76C 'privileg':13A,24B,60B,104C,109C 'right':64B 'routin':34B 'scratch':44B,88C 'trigger':79C 'use':56B 'user':66B,111C 'via':85C 'way':77C 'without':61B 'write':8A,48B,84C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product or version range, only that the flaw sits in ExecuteGraphCommand in a multiple-files component. Exposure depends on whether a local process can reach that code path, which the sources do not say.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","localprivilegeescalation","unknown"],"campaign_type":null,"search_a":"'-2026':15A,18A '-58804':16A,19A 'android':1A 'app':11A 'bound':7A 'compon':3A 'cve':14A,17A 'gain':12A 'graphic':2A 'let':9A 'local':10A 'out-of-bound':4A 'privileg':13A 'write':8A","search_b":"'allow':41B 'android':20B 'attack':54B 'bound':28B 'bounds-check':27B 'buffer':51B 'check':29B 'compon':40B 'declar':46B 'error':30B 'escal':25B,59B 'execut':63B 'executegraphcommand':33B 'extra':62B 'file':39B 'infrastructur':21B 'interact':67B 'local':23B,53B 'local-privilege-escal':22B 'memori':45B 'multipl':38B 'multiple-fil':37B 'outsid':49B 'overs':43B 'privileg':24B,60B 'right':64B 'routin':34B 'scratch':44B 'use':56B 'user':66B 'without':61B 'write':48B","search_c":"'addit':107C 'bound':83C,95C 'check':96C 'could':98C 'declar':90C 'due':91C 'escal':102C 'execut':108C 'executegraphcommand':69C 'exploit':117C 'file':72C 'incorrect':94C 'interact':112C 'lead':99C 'local':101C 'memori':89C 'multipl':71C 'need':110C,115C 'overs':87C 'possibl':76C 'privileg':104C,109C 'scratch':88C 'trigger':79C 'user':111C 'via':85C 'way':77C 'write':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58804","severity":null,"published_at":"2026-11-10T20:19:27+00:00","modified_at":"2026-11-10T20:19:27+00:00","first_seen_at":"2026-11-10T20:46:11+00:00","fetched_at":"2026-11-10T20:46:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}