EUVD-2026-115445
GHSA-m424-5fqv-ffg9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or compromise unprivileged local app
-
DeliveryInvoke vulnerable kernel code path
-
ExploitTrigger use-after-free (freed object reuse)
-
ExecutionCorrupt kernel memory
-
ImpactEscalate to kernel/root privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on the device - the attacker must already run code via an installed or compromised application; the description explicitly states no additional execution privileges and no user interaction are needed, so a zero-permission app suffices. The flaw is a use-after-free (CWE-416) stemming from a logic error present in multiple locations in the Android kernel; the precise object, syscall, or driver path that triggers the free-then-reuse is not described in the available sources. The principal limiting factor is the local attack vector (AV:L): this cannot be exploited remotely or over a network, which meaningfully reduces exposure compared to the raw 8.4 score and confines risk to devices where an attacker can already run unprivileged code. |
| Impact | This is a genuine high-severity local privilege escalation, but the real-world urgency is moderate rather than critical-now. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) with 8.4 score reflects a low-complexity local attack needing no privileges and no user interaction, yielding total compromise (C:H/I:H/A:H), which aligns with the SSVC 'Technical Impact: total' rating. However, the signals temper the raw score: SSVC reports 'Exploitation: none' and 'Automatable: no', KEV status is NOT present (no confirmed active exploitation), no EPSS score was provided in the input, and there is no verified public exploit code - only a patch commit, the Android bulletin, and a VulDB advisory entry are referenced. The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency LPE requiring local code execution first. Net: a real priority to patch in the normal Android security cadence, but it is gated behind a local-access prerequisite (a malicious or compromised app on the device) rather than being remotely weaponizable, and no evidence supports imminent mass exploitation. |
| Exploit ScenarioDerived | A malicious or compromised application already running on an Android device with no special permissions triggers a use-after-free in the Android kernel, corrupting kernel memory to escalate from an unprivileged context to kernel/root-level privileges. No user interaction is required once the app executes. No public exploit identified at time of analysis; the fix is present as an Android Open Source Project kernel commit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Local privilege escalation in the Android kernel allows code running in an unprivileged app context to escalate to kernel-level compromise, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.4, AV:L/AC:L/PR:N/UI:N). The root cause is a use-after-free (CWE-416) arising from a logic error present in multiple kernel locations; the description states no additional execution privileges and no user interaction are required, so a zero-permission application suffices as the entry point. No public exploit has been identified at time of analysis and SSVC records exploitation as none, but the fix is tracked through the November 2026 Android Security Bulletin, so exposure persists on any device that has not taken that patch level.
RemediationAI
Upstream fix available (commit); released patched version not independently confirmed - the correction is present in Android common kernel commit a4e59da7cad6b445229ae67c0ebed83a7b18dcb5, and the vendor disclosure is the Android Security Bulletin dated 2026-11-01 (https://source.android.com/docs/security/bulletin/2026/2026-11-01), which is where the applicable patched patch level should be read for each device build; the supplied data does not name an exact patched build number, so verify against that bulletin rather than assuming a version. Because the vector is local (AV:L) and requires no privileges or user interaction, the only complete fix is taking the patched kernel build, and until a device is updated its exposure can be reduced - though not removed - by limiting the install surface for untrusted or sideloaded applications and keeping Google Play Protect enabled, since the flaw needs nothing more than local code execution inside an ordinary app; these measures lower the chance of attacker code reaching the vulnerable kernel path but do not address the underlying use-after-free, and they trade away app-installation flexibility. No specific workaround, configuration toggle or feature disable is documented in the available sources.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Android kernel, as recorded by the CPE cpe:2.3:a:google:android and by EUVD's affected-version entry 'Android Android kernel'. The weakness class is CWE-416 Use After Free: memory is released and then dereferenced again, which in kernel context typically lets the reusing object be shaped by the attacker and can convert an ordinary logic error into memory corruption with control over kernel data or flow. The CVSS vector AV:L/AC:L/PR:N/UI:N/S:U means the attack is local, has low complexity, needs no privileges and no user interaction, and stays within a single security scope - consistent with an unprivileged app reaching a vulnerable kernel path. The flaw is described as occurring in multiple locations, so the code pattern rather than a single call site is the problem; the precise object, syscall or driver path that triggers the free-then-reuse is not described in the available sources. The referenced android.googlesource.com kernel/common commit a4e59da7cad6b445229ae67c0ebed83a7b18dcb5 is the upstream fix location, and the November 2026 Android Security Bulletin is the vendor disclosure vehicle.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local kernel UAF reachable by a zero-permission app (AV:L, PR:N), no user interaction, low complexity, total compromise of the kernel gives C/I/A High with unchanged scope.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
CVE-2026-59044 is a high-severity local privilege escalation in the Android kernel that allows an unprivileged app to gain kernel-level access, compromising confidentiality, integrity, and availability. Because no user interaction or permissions are required, any installed malicious app-or a compromised legitimate app-could exploit this to fully take over a device. Leadership should care because this affects the entire mobile fleet, potentially exposing sensitive corporate data and enabling persistent access to enterprise resources.
No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB