{"id":"CVE-2026-55289","published":"2026-11-02T20:17:45.293","lastModified":"2026-11-03T05:18:45.080","description":"In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-441"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy flaw in multiple functions allows local escalation of privilege by triggering execution of sensitive USSD codes without user interaction, bypassing intended authorization checks.","exploitability":"Exploitation requires local access and no additional privileges; user interaction is not needed, making it highly exploitable by a local attacker.","blast_radius":"Successful exploitation could grant full compromise of confidentiality, integrity, and availability on the affected device, enabling attackers to trigger carrier-level actions like SIM provisioning or service activation remotely.","remediation":"Upgrade to Android version 2024-11-01 patch level or later, as specified in the official Android Security Bulletin for CVE-2026-55289.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["confused-deputy","privilege-escalation","ussd","local-exploit","cwe-441"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:04:22.480Z"}}