{"id":"CVE-2026-58844","kind":"vulnerability","aliases":["CVE-2026-58844"],"related":[],"title":"Out-of-bounds read and write lets local users escalate privileges","description":"In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"An incorrect bounds check in several code locations allows out-of-bounds memory reads and writes. A local user with no extra privileges can use this to gain higher privileges on the affected system.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:48+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","triaged_at":"2026-11-02T20:39:04+00:00","updated_at":"2026-11-02T20:39:04+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-02T20:39:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Out-of-bounds read and write lets local users escalate privileges","impact":"high","summary":"An incorrect bounds check in several code locations allows out-of-bounds memory reads and writes. A local user with no extra privileges can use this to gain higher privileges on the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":[],"confidence":0.3,"fix_status":"unknown","needs_auth":"no","worst_case":"local user gains elevated privileges on the machine","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-58844 and find the vendor advisory.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product or versions, so the affected software cannot be identified from them. Systems where untrusted local users can run code are the ones to look at once the product is known.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000605,"input_tokens":4082,"output_tokens":394,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-58844':15A,18A 'addit':82C 'affect':53B 'allow':28B 'bound':4A,22B,32B,64C,70C 'check':23B,71C 'code':26B 'could':73C 'cve':13A,16A 'due':66C 'escal':11A,77C 'execut':83C 'exploit':92C 'extra':42B 'gain':48B 'higher':49B 'incorrect':21B,69C 'infrastructur':19B 'interact':87C 'lead':74C 'let':8A 'local':9A,38B,76C 'locat':27B,57C 'memori':33B 'multipl':56C 'need':85C,90C 'out-of-bound':1A,29B 'possibl':61C 'privileg':12A,43B,50B,79C,84C 'read':5A,34B 'read/write':65C 'sever':25B 'system':54B 'use':45B 'user':10A,39B,86C 'write':7A,36B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product or versions, so the affected software cannot be identified from them. Systems where untrusted local users can run code are the ones to look at once the product is known.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","unknown"],"first_public_at":"2026-11-02T20:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58844","severity":null,"published_at":"2026-11-02T20:17:48+00:00","modified_at":"2026-11-02T20:17:48+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","fetched_at":"2026-11-02T20:35:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}