{"id":"CVE-2026-58821","kind":"vulnerability","aliases":["CVE-2026-58821"],"related":[],"title":"Android search database utility: SQL injection exposes protected data locally","description":"In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"SearchRequestDatabaseUtil.java has several functions that build SQL queries unsafely, allowing SQL injection. A local app or process could read protected data and cause a local denial of service, with no extra privileges and no user interaction needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","other"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:47+00:00","first_seen_at":"2026-11-02T20:35:30+00:00","triaged_at":"2026-11-02T20:39:12+00:00","updated_at":"2026-11-02T20:39:12+00:00","category":"other","confidence":0.35,"triage":{"at":"2026-11-02T20:39:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android search database utility: SQL injection exposes protected data locally","impact":"medium","summary":"SearchRequestDatabaseUtil.java has several functions that build SQL queries unsafely, allowing SQL injection. A local app or process could read protected data and cause a local denial of service, with no extra privileges and no user interaction needed.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","mobile"],"confidence":0.35,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local app reads protected data and crashes the search service","analyst_note":"Identify the product and vendor advisory for SearchRequestDatabaseUtil.java, the affected versions, and the fixed build, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-58821.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The sources do not name the affected product or version; SearchRequestDatabaseUtil.java suggests an Android system or vendor component, so the affected devices are not confirmed. Only a device with the vulnerable component is exposed, and exploitation is local.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000646,"input_tokens":4100,"output_tokens":471,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-58821':13A,16A 'access':67C 'addit':84C 'allow':28B 'android':1A,17B 'app':33B 'build':24B 'caus':41B 'could':36B,75C 'cve':11A,14A 'data':9A,39B,69C 'databas':3A 'denial':44B,79C 'due':70C 'execut':85C 'exploit':94C 'expos':7A 'extra':49B 'function':22B,58C 'inject':6A,30B,73C 'interact':54B,89C 'lead':76C 'local':10A,32B,43B,78C 'mobil':18B 'multipl':57C 'need':55B,87C,92C 'possibl':64C 'privileg':50B,86C 'process':35B 'protect':8A,38B,68C 'queri':26B 'read':37B 'search':2A 'searchrequestdatabaseutil.java':19B,60C 'servic':46B,81C 'sever':21B 'sql':5A,25B,29B,72C 'unsaf':27B 'user':53B,88C 'util':4A 'way':65C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product or version; SearchRequestDatabaseUtil.java suggests an Android system or vendor component, so the affected devices are not confirmed. Only a device with the vulnerable component is exposed, and exploitation is local.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","mobile","other","unknown"],"first_public_at":"2026-11-02T20:17:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58821","severity":null,"published_at":"2026-11-02T20:17:47+00:00","modified_at":"2026-11-02T20:17:47+00:00","first_seen_at":"2026-11-02T20:35:30+00:00","fetched_at":"2026-11-02T20:35:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}