{"id":"CVE-2026-58857","kind":"vulnerability","aliases":["CVE-2026-58857"],"related":[],"title":"Android crypto HAL: use-after-free race lets remote code run","description":"In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A race condition in the decrypt path of CryptoHalHidl.cpp, an Android hardware crypto component, can cause a use-after-free. The description says this could lead to remote code execution without extra privileges or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mobile"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:48+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","triaged_at":"2026-11-02T20:39:01+00:00","updated_at":"2026-11-02T20:39:01+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T20:39:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Android crypto HAL: use-after-free race lets remote code run","impact":"high","summary":"A race condition in the decrypt path of CryptoHalHidl.cpp, an Android hardware crypto component, can cause a use-after-free. The description says this could lead to remote code execution without extra privileges or user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","mobile"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote code execution with no extra privileges needed","analyst_note":"Find the affected Android security bulletin and patch level for CryptoHalHidl.cpp at https://nvd.nist.gov/vuln/detail/CVE-2026-58857 and confirm the reach and fixed builds.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected Android versions or devices. The description says the flaw is reachable remotely with no user interaction, so any device running the affected crypto HAL may be exposed until a vendor patch is confirmed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000635,"input_tokens":4089,"output_tokens":453,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-58857':15A,18A 'addit':85C 'android':1A,19B,32B 'caus':37B 'code':11A,51B,81C 'compon':35B 'condit':24B,75C 'could':47B,77C 'crypto':2A,34B 'cryptohalhidl.cpp':30B,62C 'cve':13A,16A 'decrypt':27B,60C 'descript':44B 'due':71C 'execut':52B,82C,86C 'exploit':95C 'extra':54B 'free':7A,42B,70C 'hal':3A 'hardwar':33B 'infrastructur':20B 'interact':58B,90C 'lead':48B,78C 'let':9A 'mobil':21B 'need':88C,93C 'path':28B 'possibl':66C 'privileg':55B,87C 'race':8A,23B,74C 'remot':10A,50B,80C 'run':12A 'say':45B 'use':5A,40B,68C 'use-after-fre':4A,39B,67C 'user':57B,89C 'without':53B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected Android versions or devices. The description says the flaw is reachable remotely with no user interaction, so any device running the affected crypto HAL may be exposed until a vendor patch is confirmed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","mobile","unknown"],"first_public_at":"2026-11-02T20:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58857","severity":null,"published_at":"2026-11-02T20:17:48+00:00","modified_at":"2026-11-02T20:17:48+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","fetched_at":"2026-11-02T20:35:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}