pub-a-518812971

osv_android
Description

In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "database_specific": {
        "source": "https://storage.googleapis.com/android-osv/PUB-A-518812971.json"
      },
      "ecosystem_specific": {
        "severity": "Critical",
        "spl": "2026-11-05",
        "types": [
          "EoP"
        ]
      },
      "package": {
        "ecosystem": "Android",
        "name": ":unknown:"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "Pixel-family specific:0"
            },
            {
              "fixed": "Pixel-family specific:2026-11-05"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "Pixel-family specific"
      ]
    }
  ],
  "aliases": [
    "A-518812971",
    "CVE-2026-56898"
  ],
  "details": "In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "PUB-A-518812971",
  "modified": "2026-11-04T16:48:29.960526221Z",
  "published": "2026-11-01T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://source.android.com/security/bulletin/2026-11-01"
    }
  ],
  "schema_version": "1.9.2"
}
View JSON API Download JSON