CVE-2026-59614 · Infrastructure
NO FIX YET
In several functions of oem_svc_setup.c, a missing permission check lets secure cache lines be dumped into non-secure memory on warm reset. An attacker with System-level execution on the device could read secure-world data, with no user interaction needed.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
The sources do not name the affected Android or OEM builds, so the exposure cannot be confirmed from them. The flaw requires System-level execution privileges first, so it is a local, post-compromise issue rather than a remote one.
Not affected if no-system-level-access
Who cares android, oem-firmware
Unknown from the sources.
No fix yet, per the sources.
In multiple functions of oem_svc_setup.c, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.