{"id":"CVE-2026-59608","kind":"vulnerability","aliases":["CVE-2026-59608"],"related":[],"title":"Android hevc_decoder: buffer overflow in tone mapping lets local apps escalate privilege","description":"In tone_mapping_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.","summary":"A buffer overflow in the tone_mapping_info routine of the HEVC video decoder can corrupt memory outside the heap. A local app that already runs code can use it to gain higher privileges, and user interaction is needed to trigger it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","hevc","infrastructure","media-decoder"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:31+00:00","first_seen_at":"2026-11-10T20:46:14+00:00","triaged_at":"2026-11-10T20:49:44+00:00","updated_at":"2026-11-10T20:49:44+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:49:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android hevc_decoder: buffer overflow in tone mapping lets local apps escalate privilege","impact":"high","summary":"A buffer overflow in the tone_mapping_info routine of the HEVC video decoder can corrupt memory outside the heap. A local app that already runs code can use it to gain higher privileges, and user interaction is needed to trigger it.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","hevc","media-decoder"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Local code gains elevated privileges on the device","analyst_note":"Confirm the affected Android or vendor builds and the patch level that fixes CVE-2026-59608 from the vendor security bulletin; NVD text alone gives no versions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The sources do not name affected products or versions. The flaw sits in the HEVC video decoder, so devices that decode HEVC video through the vendor's media stack are the likely scope, but this is not confirmed by the sources.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4534,"output_tokens":459,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-59608':16A,19A 'alreadi':50B 'android':1A,20B 'app':11A,48B 'buffer':4A,27B,81C,86C 'code':52B 'corrupt':41B 'could':89C 'cve':14A,17A 'decod':3A,25B,39B,73C 'due':83C 'escal':12A,93C 'execut':97C 'exploit':104C 'gain':57B 'heap':45B,80C 'hevc':2A,21B,37B,72C 'higher':58B 'info':33B,70C 'infrastructur':22B 'interact':62B,101C 'lead':90C 'let':9A 'local':10A,47B,92C 'map':8A,32B,69C 'media':24B 'media-decod':23B 'memori':42B 'need':64B,99C 'non':79C 'non-heap':78C 'outsid':43B 'overflow':5A,28B,82C,87C 'possibl':77C 'privileg':13A,59B,95C,98C 'routin':34B 'run':51B 'tone':7A,31B,68C 'trigger':66B 'use':54B 'user':61B,100C 'video':38B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name affected products or versions. The flaw sits in the HEVC video decoder, so devices that decode HEVC video through the vendor's media stack are the likely scope, but this is not confirmed by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","hevc","infrastructure","mediadecoder","unknown"],"campaign_type":null,"search_a":"'-2026':15A,18A '-59608':16A,19A 'android':1A 'app':11A 'buffer':4A 'cve':14A,17A 'decod':3A 'escal':12A 'hevc':2A 'let':9A 'local':10A 'map':8A 'overflow':5A 'privileg':13A 'tone':7A","search_b":"'alreadi':50B 'android':20B 'app':48B 'buffer':27B 'code':52B 'corrupt':41B 'decod':25B,39B 'gain':57B 'heap':45B 'hevc':21B,37B 'higher':58B 'info':33B 'infrastructur':22B 'interact':62B 'local':47B 'map':32B 'media':24B 'media-decod':23B 'memori':42B 'need':64B 'outsid':43B 'overflow':28B 'privileg':59B 'routin':34B 'run':51B 'tone':31B 'trigger':66B 'use':54B 'user':61B 'video':38B","search_c":"'buffer':81C,86C 'could':89C 'decod':73C 'due':83C 'escal':93C 'execut':97C 'exploit':104C 'heap':80C 'hevc':72C 'info':70C 'interact':101C 'lead':90C 'local':92C 'map':69C 'need':99C 'non':79C 'non-heap':78C 'overflow':82C,87C 'possibl':77C 'privileg':95C,98C 'tone':68C 'user':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59608","severity":null,"published_at":"2026-11-10T20:19:31+00:00","modified_at":"2026-11-10T20:19:31+00:00","first_seen_at":"2026-11-10T20:46:14+00:00","fetched_at":"2026-11-10T20:46:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}