{"id":"CVE-2026-95400","aliases":[],"cve":{"records":[{"id":"CVE-2026-95400","source":"Google_Devices","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T05:59:06.218Z","published":"2026-11-10T19:22:41.890Z","modified":"2026-11-13T05:00:23.761Z"}],"publishers":[{"name":"Google_Devices","role":"CNA","organizationId":"83238938-5644-45f0-9007-c0392bcf6222","modified":"2026-11-10T19:22:41.890Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T05:00:23.761Z"}],"references":[{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01","tags":[],"source":"Google_Devices"}],"weaknesses":[{"id":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check.","titleSource":"Google_Devices","descriptionSource":"Google_Devices","description":"In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","score":8.4,"severity":"high","published":"2026-11-10T19:22:41.890Z","modified":"2026-11-13T05:00:23.761Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Google","name":"Android","platforms":[],"versions":[{"version":"Android kernel","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"Google_Devices","url":"https://www.cve.org/CVERecord?id=CVE-2026-95400"}],"remediation":[],"references":["https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"],"sources":[{"name":"CVE","id":"CVE-2026-95400","modified":"2026-11-13T05:00:23.761Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95400"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4}],"sourceAffected":[],"observedAt":"2026-11-13T06:40:51.793Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:55:30.737Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T21:40:31.764Z","attemptedAt":"2026-11-12T21:40:31.764Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T21:40:31.764Z","attemptedAt":"2026-11-12T21:40:31.764Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T21:40:31.764Z","attemptedAt":"2026-11-12T21:40:31.764Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-12T21:40:32.009Z","attemptedAt":"2026-11-12T21:40:32.009Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-95400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95400","modified":"2026-11-12T19:17:06.373","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-12T21:40:31.764Z"},{"source":"ENISA EUVD","id":"EUVD-2026-122677","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-122677","modified":"Nov 12, 2026, 7:08:38 PM","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-12T21:40:31.764Z"},{"source":"GitHub Advisory Database","id":"GHSA-hmj6-x5h8-qhhf","url":"https://github.com/advisories/GHSA-hmj6-x5h8-qhhf","modified":"2026-11-12T21:32:05Z","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-12T21:40:31.764Z"},{"source":"FIRST EPSS","id":"CVE-2026-95400","url":"https://www.first.org/epss/","probability":0.00132,"percentile":0.02836,"date":"2026-11-12","checkedAt":"2026-11-12T21:40:32.009Z"}],"aiSummary":{"text":"Android kernel has a possible out of bounds write due to an incorrect bounds check in StNfc_hal_write, potentially leading to local escalation of privilege. User interaction is not needed for exploitation. The vulnerability is caused by an improper restriction of operations within the bounds of a memory buffer.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-12T21:11:06.703Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95400"}]}}