CVE-2026-59628

MediumCVSS 4.0/10Last modified Nov 12, 2026

Description

In s_copy_host_apb_param of multiple files, there is a possible way to trigger an out of bounds read in the video decoder command queue due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Google	Android	Android kernel

References

https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-59639.8EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL comm CVE-2026-596308.4In check_constraint_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass rollback protection due CVE-2026-596317.8In s_inter_rps_pred of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalat CVE-2026-596327.5In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via an undrained message queue d CVE-2026-596357.8In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of pri CVE-2026-596366.2In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of service via premature anti-CVE-2026-596373.3In userdata_report of hwcodec_firmware, there is a possible Logic error due to a logic error in the code. This could lead to local informati CVE-2026-596386.5In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affe CVE-2026-596397.5In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Ca CVE-2026-59649.8EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL comm CVE-2026-596405.3In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy CVE-2026-596415.3In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Boun