---
id: "CVE-2026-58804"
page: "https://infrastack.ai/live/CVE-2026-58804"
kind: "vulnerability"
aliases: ["CVE-2026-58804"]
title: "Android graphics component: out-of-bounds write lets local apps gain privileges"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "infrastructure", "local-privilege-escalation"]
not_affected_if: ["unknown"]
published_at: "2026-11-10T20:19:27+00:00"
first_seen_at: "2026-11-10T20:46:11+00:00"
updated_at: "2026-11-10T20:51:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58804", "first_seen_at": "2026-11-10T20:46:11+00:00"}]
exploit_sources: []
---

# Android graphics component: out-of-bounds write lets local apps gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-58804 (this .md is for agents)

A bounds-check error in the ExecuteGraphCommand routine of the multiple-files component allows an oversized scratch memory declaration to write outside its buffer. A local attacker can use this to escalate privileges without extra execution rights or user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58804

## From the sources

In ExecuteGraphCommand of multiple files, there is a possible way to trigger an out of bounds write via an oversized scratch memory declaration due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_