{"id":"CVE-2026-59593","kind":"vulnerability","aliases":["CVE-2026-59593"],"related":[],"title":"Android AV1 decoder heap overflow allows local privilege escalation","description":"In tile_info of av1_decoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.","summary":"A heap buffer overflow in the tile_info routine of the AV1 video decoder can be triggered to escalate privileges on a device. An attacker who already runs code locally, with user interaction needed, could gain higher privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","av1","infrastructure","video-decoder"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:29+00:00","first_seen_at":"2026-11-10T20:46:13+00:00","triaged_at":"2026-11-10T20:49:59+00:00","updated_at":"2026-11-10T20:49:59+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:49:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android AV1 decoder heap overflow allows local privilege escalation","impact":"high","summary":"A heap buffer overflow in the tile_info routine of the AV1 video decoder can be triggered to escalate privileges on a device. An attacker who already runs code locally, with user interaction needed, could gain higher privileges.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","av1","video-decoder"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local code gains elevated privileges on the device","analyst_note":"Identify the affected platform and patch level from the NVD entry or vendor bulletin; the sources given do not name the product or fixed version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000631,"input_tokens":4522,"output_tokens":358,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-59593':12A,15A 'allow':6A 'alreadi':48B 'android':1A,16B 'attack':46B 'av1':2A,17B,33B,64C 'buffer':24B,71C,77C 'code':50B 'could':56B,80C 'cve':10A,13A 'decod':3A,21B,35B,65C 'devic':44B 'due':73C 'escal':9A,40B,84C 'execut':88C 'exploit':95C 'gain':57B 'heap':4A,23B,70C,76C 'higher':58B 'info':29B,62C 'infrastructur':18B 'interact':54B,92C 'lead':81C 'local':7A,51B,83C 'need':55B,90C 'overflow':5A,25B,72C,78C 'possibl':69C 'privileg':8A,41B,59B,86C,89C 'routin':30B 'run':49B 'tile':28B,61C 'trigger':38B 'user':53B,91C 'video':20B,34B 'video-decod':19B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","av1","infrastructure","unknown","videodecoder"],"campaign_type":null,"search_a":"'-2026':11A,14A '-59593':12A,15A 'allow':6A 'android':1A 'av1':2A 'cve':10A,13A 'decod':3A 'escal':9A 'heap':4A 'local':7A 'overflow':5A 'privileg':8A","search_b":"'alreadi':48B 'android':16B 'attack':46B 'av1':17B,33B 'buffer':24B 'code':50B 'could':56B 'decod':21B,35B 'devic':44B 'escal':40B 'gain':57B 'heap':23B 'higher':58B 'info':29B 'infrastructur':18B 'interact':54B 'local':51B 'need':55B 'overflow':25B 'privileg':41B,59B 'routin':30B 'run':49B 'tile':28B 'trigger':38B 'user':53B 'video':20B,34B 'video-decod':19B","search_c":"'av1':64C 'buffer':71C,77C 'could':80C 'decod':65C 'due':73C 'escal':84C 'execut':88C 'exploit':95C 'heap':70C,76C 'info':62C 'interact':92C 'lead':81C 'local':83C 'need':90C 'overflow':72C,78C 'possibl':69C 'privileg':86C,89C 'tile':61C 'user':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59593","severity":null,"published_at":"2026-11-10T20:19:29+00:00","modified_at":"2026-11-10T20:19:29+00:00","first_seen_at":"2026-11-10T20:46:13+00:00","fetched_at":"2026-11-10T20:46:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}