{"id":"CVE-2026-59573","kind":"vulnerability","aliases":["CVE-2026-59573"],"related":[],"title":"Android avc_decoder: buffer overflow in max_num_ref_frames enables local privilege escalation","description":"In max_num_ref_frames of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.","summary":"A buffer overflow in the max_num_ref_frames handling of the avc_decoder lets a process write outside a heap buffer. Per the description, an attacker with local code execution can escalate privileges, and user interaction is needed to exploit it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","media-codec","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:28+00:00","first_seen_at":"2026-11-10T20:46:12+00:00","triaged_at":"2026-11-10T20:50:06+00:00","updated_at":"2026-11-10T20:50:06+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T20:50:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android avc_decoder: buffer overflow in max_num_ref_frames enables local privilege escalation","impact":"high","summary":"A buffer overflow in the max_num_ref_frames handling of the avc_decoder lets a process write outside a heap buffer. Per the description, an attacker with local code execution can escalate privileges, and user interaction is needed to exploit it.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","media-codec"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local app gains elevated privileges on the device","analyst_note":"Confirm the affected Android component and patch level from the NVD entry or the Android security bulletin; the sources give no versions or products.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000644,"input_tokens":4534,"output_tokens":381,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-59573':17A,20A 'android':1A,21B 'attack':51B 'avc':2A,37B,72C 'buffer':4A,26B,46B,81C,86C 'code':54B 'codec':24B 'could':89C 'cve':15A,18A 'decod':3A,38B,73C 'descript':49B 'due':83C 'enabl':11A 'escal':14A,57B,93C 'execut':55B,97C 'exploit':65B,104C 'frame':10A,33B,70C 'handl':34B 'heap':45B,80C 'interact':61B,101C 'lead':90C 'let':39B 'local':12A,53B,92C 'max':7A,30B,67C 'media':23B 'media-codec':22B 'need':63B,99C 'non':79C 'non-heap':78C 'num':8A,31B,68C 'outsid':43B 'overflow':5A,27B,82C,87C 'per':47B 'possibl':77C 'privileg':13A,58B,95C,98C 'process':41B 'ref':9A,32B,69C 'user':60B,100C 'write':42B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","mediacodec","other","unknown"],"campaign_type":null,"search_a":"'-2026':16A,19A '-59573':17A,20A 'android':1A 'avc':2A 'buffer':4A 'cve':15A,18A 'decod':3A 'enabl':11A 'escal':14A 'frame':10A 'local':12A 'max':7A 'num':8A 'overflow':5A 'privileg':13A 'ref':9A","search_b":"'android':21B 'attack':51B 'avc':37B 'buffer':26B,46B 'code':54B 'codec':24B 'decod':38B 'descript':49B 'escal':57B 'execut':55B 'exploit':65B 'frame':33B 'handl':34B 'heap':45B 'interact':61B 'let':39B 'local':53B 'max':30B 'media':23B 'media-codec':22B 'need':63B 'num':31B 'outsid':43B 'overflow':27B 'per':47B 'privileg':58B 'process':41B 'ref':32B 'user':60B 'write':42B","search_c":"'avc':72C 'buffer':81C,86C 'could':89C 'decod':73C 'due':83C 'escal':93C 'execut':97C 'exploit':104C 'frame':70C 'heap':80C 'interact':101C 'lead':90C 'local':92C 'max':67C 'need':99C 'non':79C 'non-heap':78C 'num':68C 'overflow':82C,87C 'possibl':77C 'privileg':95C,98C 'ref':69C 'user':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59573","severity":null,"published_at":"2026-11-10T20:19:28+00:00","modified_at":"2026-11-10T20:19:28+00:00","first_seen_at":"2026-11-10T20:46:12+00:00","fetched_at":"2026-11-10T20:46:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}