Live › vulnerability › CVE-2026-59003
A missing permission check in the Android SubscriptionManagerService getSubscriptionProperty method lets an app on the same device read subscription information it should not see. The sources describe local information disclosure only, with no extra execution privileges and no user interaction needed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
The sources describe a local flaw in Android's telephony subscription service, which affects devices running the vulnerable Android builds. They do not name the affected Android versions or patch levels, so check your device's security patch level in Settings and install pending system updates. Systems that cannot receive Android updates may remain exposed.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-59003")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.