{"id":"CVE-2026-59596","kind":"vulnerability","aliases":["CVE-2026-59596"],"related":[],"title":"Security coprocessor mpu.c flaw lets non-secure memory code run locally","description":"In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"Several functions in mpu.c use an insecure default value, which lets code in non-secure memory execute inside the security coprocessor. An attacker with local access can escalate privileges without extra execution rights or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","infrastructure","security-coprocessor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:30+00:00","first_seen_at":"2026-11-10T20:46:13+00:00","triaged_at":"2026-11-10T20:49:54+00:00","updated_at":"2026-11-10T20:49:54+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T20:49:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Security coprocessor mpu.c flaw lets non-secure memory code run locally","impact":"high","summary":"Several functions in mpu.c use an insecure default value, which lets code in non-secure memory execute inside the security coprocessor. An attacker with local access can escalate privileges without extra execution rights or user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["security-coprocessor","firmware"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code runs inside the security coprocessor, escalating privileges locally","analyst_note":"Identify the vendor and affected firmware from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-59596 and find the patched version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected device, chip or firmware, so unknown. The flaw is local, so it matters only where an attacker already runs code on the device.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":4528,"output_tokens":427,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59596':15A,18A 'access':50B 'addit':99C 'attack':47B 'code':10A,35B,73C 'coprocessor':2A,23B,45B,82C 'could':90C 'cve':13A,16A 'default':31B,87C 'due':83C 'escal':52B,94C 'execut':41B,56B,72C,100C 'exploit':109C 'extra':55B 'firmwar':19B 'flaw':4A 'function':25B,63C 'infrastructur':20B 'insecur':30B,86C 'insid':42B 'interact':60B,104C 'lead':91C 'let':5A,34B 'local':12A,49B,93C 'memori':9A,40B,78C 'mpu.c':3A,27B,65C 'multipl':62C 'need':102C,107C 'non':7A,38B,76C 'non-secur':6A,37B,75C 'possibl':69C 'privileg':53B,96C,101C 'right':57B 'run':11A 'secur':1A,8A,22B,39B,44B,77C,81C 'security-coprocessor':21B 'sever':24B 'use':28B 'user':59B,103C 'valu':32B,88C 'way':70C 'without':54B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected device, chip or firmware, so unknown. The flaw is local, so it matters only where an attacker already runs code on the device.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firmware","infrastructure","securitycoprocessor","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-59596':15A,18A 'code':10A 'coprocessor':2A 'cve':13A,16A 'flaw':4A 'let':5A 'local':12A 'memori':9A 'mpu.c':3A 'non':7A 'non-secur':6A 'run':11A 'secur':1A,8A","search_b":"'access':50B 'attack':47B 'code':35B 'coprocessor':23B,45B 'default':31B 'escal':52B 'execut':41B,56B 'extra':55B 'firmwar':19B 'function':25B 'infrastructur':20B 'insecur':30B 'insid':42B 'interact':60B 'let':34B 'local':49B 'memori':40B 'mpu.c':27B 'non':38B 'non-secur':37B 'privileg':53B 'right':57B 'secur':22B,39B,44B 'security-coprocessor':21B 'sever':24B 'use':28B 'user':59B 'valu':32B 'without':54B","search_c":"'addit':99C 'code':73C 'coprocessor':82C 'could':90C 'default':87C 'due':83C 'escal':94C 'execut':72C,100C 'exploit':109C 'function':63C 'insecur':86C 'interact':104C 'lead':91C 'local':93C 'memori':78C 'mpu.c':65C 'multipl':62C 'need':102C,107C 'non':76C 'non-secur':75C 'possibl':69C 'privileg':96C,101C 'secur':77C,81C 'user':103C 'valu':88C 'way':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59596","severity":null,"published_at":"2026-11-10T20:19:30+00:00","modified_at":"2026-11-10T20:19:30+00:00","first_seen_at":"2026-11-10T20:46:13+00:00","fetched_at":"2026-11-10T20:46:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}