CVE-2026-56926

Not scored yetLast modified Nov 10, 2026

Description

In multiple functions of PssSubscriptionManager.java, there is a possible way to spoof subscription switch results and trigger a device reboot due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-56929In TrustyKeyMintManager::VerifyHat of trusty_keymint_manager.cc, there is a possible Security check bypass due to a logic error in the code.CVE-2026-56935.3The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check anCVE-2026-569308.4In smmu_find_ste of smmu.c, there is a possible way to retain stale translation lookaside buffer entries across stream identifiers due to a CVE-2026-569326.7In Trusted Execution Environment, there is a possible memory corruption due to improper input validation. This could lead to local escalatioCVE-2026-569337.8In RecordApTx of efw_ap_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalatCVE-2026-56934In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic error in the code. ThisCVE-2026-56935In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. This could lead to local informationCVE-2026-569366.8In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physiCVE-2026-56938In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalation of privilege withCVE-2026-56947.2The Quick Interest Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'loan-amount' and 'loan-period' parameteCVE-2026-569418.4In multiple functions of fpc_tee_hal.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalaCVE-2026-569428.8In ReadTileInfo of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escal
CVE-2026-56926: Unscored | Vulnix