---
id: "CVE-2026-58805"
page: "https://infrastack.ai/live/CVE-2026-58805"
kind: "vulnerability"
aliases: ["CVE-2026-58805"]
title: "Android-style firmware: missing bounds check lets attacker zero secure memory"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firmware", "infrastructure", "secure-memory"]
not_affected_if: []
published_at: "2026-11-10T20:19:27+00:00"
first_seen_at: "2026-11-10T20:46:11+00:00"
updated_at: "2026-11-10T20:51:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58805", "first_seen_at": "2026-11-10T20:46:11+00:00"}]
exploit_sources: []
---

# Android-style firmware: missing bounds check lets attacker zero secure memory

Link for people: https://infrastack.ai/live/CVE-2026-58805 (this .md is for agents)

Multiple locations lack a bounds check on image body addresses, so unvalidated addresses can zero arbitrary secure memory. The description says this leads to physical privilege escalation with System execution privileges needed and no user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58805

## From the sources

In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing bounds check. This could lead to physical escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_