{"id":"CVE-2026-58828","kind":"vulnerability","aliases":["CVE-2026-58828"],"related":[],"title":"Unknown component: base.c use-after-free race lets local users escalate privilege","description":"In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A race condition in several functions of base.c can free memory that is still in use, a use-after-free. A local user with no extra privileges can use it to gain higher privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:47+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","triaged_at":"2026-11-02T20:39:08+00:00","updated_at":"2026-11-02T20:39:08+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-02T20:39:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Unknown component: base.c use-after-free race lets local users escalate privilege","impact":"high","summary":"A race condition in several functions of base.c can free memory that is still in use, a use-after-free. A local user with no extra privileges can use it to gain higher privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":[],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the machine","analyst_note":"Identify the product containing base.c and the affected versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-58828.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources do not name the product or driver that contains base.c, so it is not possible to tell which systems run the affected code. Any system where untrusted local users can run code would be the concern once the product is identified.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000607,"input_tokens":4074,"output_tokens":399,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-58828':16A,19A 'addit':84C 'base.c':3A,28B,60C 'compon':2A 'condit':23B,73C 'could':75C 'cve':14A,17A 'due':69C 'escal':12A,79C 'execut':85C 'exploit':94C 'extra':47B 'free':7A,30B,41B,68C 'function':26B,58C 'gain':53B 'higher':54B 'infrastructur':20B 'interact':89C 'lead':76C 'let':9A 'local':10A,43B,78C 'memori':31B 'multipl':57C 'need':87C,92C 'possibl':64C 'privileg':13A,48B,55B,81C,86C 'race':8A,22B,72C 'sever':25B 'still':34B 'unknown':1A 'use':5A,36B,39B,50B,66C 'use-after-fre':4A,38B,65C 'user':11A,44B,88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","unknown"],"first_public_at":"2026-11-02T20:17:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58828","severity":null,"published_at":"2026-11-02T20:17:47+00:00","modified_at":"2026-11-02T20:17:47+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","fetched_at":"2026-11-02T20:35:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}