{"id":"CVE-2026-59044","kind":"vulnerability","aliases":["CVE-2026-59044"],"related":[],"title":"Unnamed product: use-after-free logic error allows local privilege escalation","description":"In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A use-after-free bug in multiple code locations lets code that already runs on the device reuse freed memory. An attacker with local access can escalate privileges without extra execution rights or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:57+00:00","first_seen_at":"2026-11-02T20:35:37+00:00","triaged_at":"2026-11-02T20:36:48+00:00","updated_at":"2026-11-02T20:36:48+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-02T20:36:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Unnamed product: use-after-free logic error allows local privilege escalation","impact":"high","summary":"A use-after-free bug in multiple code locations lets code that already runs on the device reuse freed memory. An attacker with local access can escalate privileges without extra execution rights or user interaction.","audience":"businesses","category":"other","nicknames":[],"who_cares":[],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local user gains elevated privileges on the affected system","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-59044 and the vendor advisory it cites.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product, versions or component, so the exposed systems cannot be identified from this text. Local access to the machine is required, so systems with no untrusted local users or code are at lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000612,"input_tokens":4072,"output_tokens":409,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59044':15A,18A 'access':44B 'addit':84C 'allow':9A 'alreadi':32B 'attack':41B 'bug':24B 'code':27B,30B,73C 'could':75C 'cve':13A,16A 'devic':36B 'due':66C 'error':8A,70C 'escal':12A,46B,79C 'execut':50B,85C 'exploit':94C 'extra':49B 'free':6A,23B,65C 'freed':38B 'interact':54B,89C 'lead':76C 'let':29B 'local':10A,43B,78C 'locat':28B,57C 'logic':7A,69C 'memori':39B 'multipl':26B,56C 'need':87C,92C 'possibl':61C 'privileg':11A,47B,81C,86C 'product':2A 'reus':37B 'right':51B 'run':33B 'unnam':1A 'use':4A,21B,63C 'use-after-fre':3A,20B,62C 'user':53B,88C 'without':48B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product, versions or component, so the exposed systems cannot be identified from this text. Local access to the machine is required, so systems with no untrusted local users or code are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["other","unknown"],"first_public_at":"2026-11-02T20:17:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59044","severity":null,"published_at":"2026-11-02T20:17:57+00:00","modified_at":"2026-11-02T20:17:57+00:00","first_seen_at":"2026-11-02T20:35:37+00:00","fetched_at":"2026-11-02T20:35:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}