---
id: "CVE-2026-59596"
page: "https://infrastack.ai/live/CVE-2026-59596"
kind: "vulnerability"
aliases: ["CVE-2026-59596"]
title: "Security coprocessor mpu.c flaw lets non-secure memory code run locally"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firmware", "infrastructure", "security-coprocessor"]
not_affected_if: []
published_at: "2026-11-10T20:19:30+00:00"
first_seen_at: "2026-11-10T20:46:13+00:00"
updated_at: "2026-11-10T20:49:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59596", "first_seen_at": "2026-11-10T20:46:13+00:00"}]
exploit_sources: []
---

# Security coprocessor mpu.c flaw lets non-secure memory code run locally

Link for people: https://infrastack.ai/live/CVE-2026-59596 (this .md is for agents)

Several functions in mpu.c use an insecure default value, which lets code in non-secure memory execute inside the security coprocessor. An attacker with local access can escalate privileges without extra execution rights or user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59596

## From the sources

In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_