{"id":"CVE-2026-59587","kind":"vulnerability","aliases":["CVE-2026-59587"],"related":[],"title":"Android NFC stack: out-of-bounds write lets a local app gain privileges","description":"In stpropnci_prop_st_build_set_custom_polling_cmd of stpropnci_prop_st.cc, there is a possible way to trigger an out of bounds write into global memory due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A missing bounds check in an NFC property routine lets code write outside a memory buffer. A local app with no extra permissions could use this to escalate its privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","nfc"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:29+00:00","first_seen_at":"2026-11-10T20:46:13+00:00","triaged_at":"2026-11-10T20:49:57+00:00","updated_at":"2026-11-10T20:49:57+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:49:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android NFC stack: out-of-bounds write lets a local app gain privileges","impact":"high","summary":"A missing bounds check in an NFC property routine lets code write outside a memory buffer. A local app with no extra permissions could use this to escalate its privileges.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","nfc"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"local app gains elevated privileges on the device","analyst_note":"Confirm the affected Android versions and patch level in the NVD entry or the Android security bulletin; the sources given state no versions or fix.","how_to_check":"unknown","plain_action":"Install the latest Android security update on your phone once your manufacturer publishes it.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000644,"input_tokens":4571,"output_tokens":373,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-59587':17A,20A 'addit':96C 'android':1A,21B 'app':12A,42B 'bound':7A,26B,75C,84C 'buffer':39B 'build':58C 'check':27B,85C 'cmd':62C 'code':34B 'could':47B,87C 'custom':60C 'cve':15A,18A 'due':80C 'escal':51B,91C 'execut':97C 'exploit':106C 'extra':45B 'gain':13A 'global':78C 'infrastructur':22B 'interact':101C 'lead':88C 'let':9A,33B 'local':11A,41B,90C 'memori':38B,79C 'miss':25B,83C 'need':99C,104C 'nfc':2A,23B,30B 'out-of-bound':4A 'outsid':36B 'permiss':46B 'poll':61C 'possibl':68C 'privileg':14A,53B,93C,98C 'prop':56C 'properti':31B 'routin':32B 'set':59C 'st':57C 'stack':3A 'stpropnci':55C 'stpropnci_prop_st.cc':64C 'trigger':71C 'use':48B 'user':100C 'way':69C 'write':8A,35B,76C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","nfc","unknown"],"campaign_type":null,"search_a":"'-2026':16A,19A '-59587':17A,20A 'android':1A 'app':12A 'bound':7A 'cve':15A,18A 'gain':13A 'let':9A 'local':11A 'nfc':2A 'out-of-bound':4A 'privileg':14A 'stack':3A 'write':8A","search_b":"'android':21B 'app':42B 'bound':26B 'buffer':39B 'check':27B 'code':34B 'could':47B 'escal':51B 'extra':45B 'infrastructur':22B 'let':33B 'local':41B 'memori':38B 'miss':25B 'nfc':23B,30B 'outsid':36B 'permiss':46B 'privileg':53B 'properti':31B 'routin':32B 'use':48B 'write':35B","search_c":"'addit':96C 'bound':75C,84C 'build':58C 'check':85C 'cmd':62C 'could':87C 'custom':60C 'due':80C 'escal':91C 'execut':97C 'exploit':106C 'global':78C 'interact':101C 'lead':88C 'local':90C 'memori':79C 'miss':83C 'need':99C,104C 'poll':61C 'possibl':68C 'privileg':93C,98C 'prop':56C 'set':59C 'st':57C 'stpropnci':55C 'stpropnci_prop_st.cc':64C 'trigger':71C 'user':100C 'way':69C 'write':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59587","severity":null,"published_at":"2026-11-10T20:19:29+00:00","modified_at":"2026-11-10T20:19:29+00:00","first_seen_at":"2026-11-10T20:46:13+00:00","fetched_at":"2026-11-10T20:46:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}