{"id":"CVE-2026-59596","aliases":[],"cve":{"records":[{"id":"CVE-2026-59596","source":"Google_Devices","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-06T06:25:53.894Z","published":"2026-11-10T19:22:10.871Z","modified":"2026-11-13T05:01:34.798Z"}],"publishers":[{"name":"Google_Devices","role":"CNA","organizationId":"83238938-5644-45f0-9007-c0392bcf6222","modified":"2026-11-10T19:22:10.871Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T05:01:34.798Z"}],"references":[{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01","tags":[],"source":"Google_Devices"}],"weaknesses":[{"id":"CWE-453","description":"CWE-453 Insecure Default Variable Initialization","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value.","titleSource":"Google_Devices","descriptionSource":"Google_Devices","description":"In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","score":8.4,"severity":"high","published":"2026-11-10T19:22:10.871Z","modified":"2026-11-13T05:01:34.798Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Google","name":"Android","platforms":[],"versions":[{"version":"Android kernel","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"Google_Devices","url":"https://www.cve.org/CVERecord?id=CVE-2026-59596"}],"remediation":[],"references":["https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"],"sources":[{"name":"CVE","id":"CVE-2026-59596","modified":"2026-11-13T05:01:34.798Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-59596"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4}],"sourceAffected":[],"observedAt":"2026-11-13T09:56:32.696Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:15:31.991Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T10:00:52.090Z","attemptedAt":"2026-11-13T10:00:52.090Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T10:00:33.655Z","attemptedAt":"2026-11-13T10:00:33.655Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T10:00:33.398Z","attemptedAt":"2026-11-13T10:00:33.398Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T10:00:33.398Z","attemptedAt":"2026-11-13T10:00:33.398Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-59596","url":"https://www.first.org/epss/","probability":0.00142,"percentile":0.03573,"date":"2026-11-12","checkedAt":"2026-11-13T10:00:33.398Z"},{"source":"ENISA EUVD","id":"EUVD-2026-122644","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-122644","modified":"Nov 13, 2026, 5:01:34 AM","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-13T10:00:33.398Z"},{"source":"GitHub Advisory Database","id":"GHSA-w6wv-8gwr-jpvm","url":"https://github.com/advisories/GHSA-w6wv-8gwr-jpvm","modified":"2026-11-12T21:31:00Z","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-13T10:00:33.655Z"},{"source":"NVD","id":"CVE-2026-59596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59596","modified":"2026-11-13T05:18:50.410","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-13T10:00:52.090Z"}],"aiSummary":{"text":"The Android kernel has a vulnerability due to an insecure default value in mpu.c, potentially allowing local privilege escalation. User interaction is not required for exploitation. The exact impact is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T10:01:08.072Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-59596"}]}}