{"id":"CVE-2026-59574","kind":"vulnerability","aliases":["CVE-2026-59574"],"related":[],"title":"Android firmware log code: out-of-bounds read and write from bad bounds check","description":"In notifyPollingLoopFrames of hal_fwlog.cc, there is a possible way to trigger an out of bounds read and write when formatting firmware log notifications due to an incorrect bounds check. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A bounds check in notifyPollingLoopFrames in hal_fwlog.cc is wrong, so formatting firmware log notifications can read and write outside allocated memory. The description says this could lead to physical information disclosure without extra privileges and without user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hal_fwlog","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","firmware-logging","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:28+00:00","first_seen_at":"2026-11-10T20:46:12+00:00","triaged_at":"2026-11-10T20:50:07+00:00","updated_at":"2026-11-10T20:50:07+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-10T20:50:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android firmware log code: out-of-bounds read and write from bad bounds check","impact":"medium","summary":"A bounds check in notifyPollingLoopFrames in hal_fwlog.cc is wrong, so formatting firmware log notifications can read and write outside allocated memory. The description says this could lead to physical information disclosure without extra privileges and without user interaction.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","firmware-logging"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"memory corruption leaks device information to a nearby attacker","analyst_note":"Identify the affected Android or vendor build and patch level from the NVD entry and Android security bulletin; sources give no product, versions or fix.","how_to_check":"unknown","plain_action":"","product_name":"hal_fwlog","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000657,"input_tokens":4559,"output_tokens":402,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-59574':18A,21A 'addit':104C 'alloc':47B 'android':1A,24B 'bad':13A 'bound':8A,14A,29B,80C,93C 'check':15A,30B,94C 'code':4A 'could':53B,96C 'cve':16A,19A 'descript':50B 'disclosur':58B,101C 'due':89C 'execut':105C 'exploit':114C 'extra':60B 'firmwar':2A,26B,39B,86C 'firmware-log':25B 'format':38B,85C 'fwlog':23A 'hal':22A 'hal_fwlog.cc':34B,69C 'incorrect':92C 'inform':57B,100C 'interact':65B,109C 'lead':54B,97C 'log':3A,27B,40B,87C 'memori':48B 'need':107C,112C 'notif':41B,88C 'notifypollingloopfram':32B,67C 'out-of-bound':5A 'outsid':46B 'physic':56B,99C 'possibl':73C 'privileg':61B,106C 'read':9A,43B,81C 'say':51B 'trigger':76C 'user':64B,108C 'way':74C 'without':59B,63B 'write':11A,45B,83C 'wrong':36B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":["halfwlog"],"ptokens":["fwlog","hal"],"labels":["android","firmwarelogging","other","unknown","vendor"],"campaign_type":null,"search_a":"'-2026':17A,20A '-59574':18A,21A 'android':1A 'bad':13A 'bound':8A,14A 'check':15A 'code':4A 'cve':16A,19A 'firmwar':2A 'fwlog':23A 'hal':22A 'log':3A 'out-of-bound':5A 'read':9A 'write':11A","search_b":"'alloc':47B 'android':24B 'bound':29B 'check':30B 'could':53B 'descript':50B 'disclosur':58B 'extra':60B 'firmwar':26B,39B 'firmware-log':25B 'format':38B 'hal_fwlog.cc':34B 'inform':57B 'interact':65B 'lead':54B 'log':27B,40B 'memori':48B 'notif':41B 'notifypollingloopfram':32B 'outsid':46B 'physic':56B 'privileg':61B 'read':43B 'say':51B 'user':64B 'without':59B,63B 'write':45B 'wrong':36B","search_c":"'addit':104C 'bound':80C,93C 'check':94C 'could':96C 'disclosur':101C 'due':89C 'execut':105C 'exploit':114C 'firmwar':86C 'format':85C 'hal_fwlog.cc':69C 'incorrect':92C 'inform':100C 'interact':109C 'lead':97C 'log':87C 'need':107C,112C 'notif':88C 'notifypollingloopfram':67C 'physic':99C 'possibl':73C 'privileg':106C 'read':81C 'trigger':76C 'user':108C 'way':74C 'write':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59574","severity":null,"published_at":"2026-11-10T20:19:28+00:00","modified_at":"2026-11-10T20:19:28+00:00","first_seen_at":"2026-11-10T20:46:12+00:00","fetched_at":"2026-11-10T20:46:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}