{"id":"CVE-2026-58805","kind":"vulnerability","aliases":["CVE-2026-58805"],"related":[],"title":"Android-style firmware: missing bounds check lets attacker zero secure memory","description":"In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing bounds check. This could lead to physical escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","summary":"Multiple locations lack a bounds check on image body addresses, so unvalidated addresses can zero arbitrary secure memory. The description says this leads to physical privilege escalation with System execution privileges needed and no user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","infrastructure","secure-memory"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:27+00:00","first_seen_at":"2026-11-10T20:46:11+00:00","triaged_at":"2026-11-10T20:51:32+00:00","updated_at":"2026-11-10T20:51:32+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T20:51:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android-style firmware: missing bounds check lets attacker zero secure memory","impact":"high","summary":"Multiple locations lack a bounds check on image body addresses, so unvalidated addresses can zero arbitrary secure memory. The description says this leads to physical privilege escalation with System execution privileges needed and no user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["firmware","secure-memory"],"confidence":0.3,"fix_status":"unknown","needs_auth":"yes","worst_case":"Secure memory zeroed, enabling physical privilege escalation on the device","analyst_note":"Identify the affected product and vendor patch level from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-58805) and the vendor bulletin; the description names no product.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4529,"output_tokens":409,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-58805':15A,18A 'address':33B,36B,77C 'android':2A 'android-styl':1A 'arbitrari':39B,70C 'attack':9A 'bodi':32B,76C 'bound':6A,28B,82C 'check':7A,29B,83C 'could':85C 'cve':13A,16A 'descript':43B 'due':78C 'escal':50B,89C 'execut':53B,94C 'exploit':103C 'firmwar':4A,19B 'imag':31B,75C 'infrastructur':20B 'interact':59B,98C 'lack':26B 'lead':46B,86C 'let':8A 'locat':25B,62C 'memori':12A,23B,41B,72C 'miss':5A,81C 'multipl':24B,61C 'need':55B,96C,101C 'physic':48B,88C 'possibl':66C 'privileg':49B,54B,91C,95C 'say':44B 'secur':11A,22B,40B,71C 'secure-memori':21B 'style':3A 'system':52B,93C 'unvalid':35B,74C 'user':58B,97C 'via':73C 'way':67C 'zero':10A,38B,69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firmware","infrastructure","securememory","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-58805':15A,18A 'android':2A 'android-styl':1A 'attack':9A 'bound':6A 'check':7A 'cve':13A,16A 'firmwar':4A 'let':8A 'memori':12A 'miss':5A 'secur':11A 'style':3A 'zero':10A","search_b":"'address':33B,36B 'arbitrari':39B 'bodi':32B 'bound':28B 'check':29B 'descript':43B 'escal':50B 'execut':53B 'firmwar':19B 'imag':31B 'infrastructur':20B 'interact':59B 'lack':26B 'lead':46B 'locat':25B 'memori':23B,41B 'multipl':24B 'need':55B 'physic':48B 'privileg':49B,54B 'say':44B 'secur':22B,40B 'secure-memori':21B 'system':52B 'unvalid':35B 'user':58B 'zero':38B","search_c":"'address':77C 'arbitrari':70C 'bodi':76C 'bound':82C 'check':83C 'could':85C 'due':78C 'escal':89C 'execut':94C 'exploit':103C 'imag':75C 'interact':98C 'lead':86C 'locat':62C 'memori':72C 'miss':81C 'multipl':61C 'need':96C,101C 'physic':88C 'possibl':66C 'privileg':91C,95C 'secur':71C 'system':93C 'unvalid':74C 'user':97C 'via':73C 'way':67C 'zero':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58805","severity":null,"published_at":"2026-11-10T20:19:27+00:00","modified_at":"2026-11-10T20:19:27+00:00","first_seen_at":"2026-11-10T20:46:11+00:00","fetched_at":"2026-11-10T20:46:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}