{"id":"CVE-2026-58828","published":"2026-11-02T20:17:47.817","lastModified":"2026-11-03T05:18:45.987","description":"In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","tags":[]},{"url":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec","tags":[]},{"url":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","tags":[]},{"url":"https://android.googlesource.com/kernel/common/+/f118039ccd1a98d1c4931816832b28c3c9e8e471","tags":[]},{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability in base.c allows an unprivileged local attacker to trigger a race condition that leads to accessing freed memory, potentially enabling privilege escalation without user interaction.","exploitability":"Exploitation requires local access and precise timing to race the memory free/reuse window; no additional privileges or user interaction are needed.","blast_radius":"Successful exploitation could grant an unprivileged local attacker full system compromise (CIA impact high) on affected systems, with no network exposure required.","remediation":"Apply the vendor patch for CVE-2026-58828 when released; until then, restrict local shell access and disable non-essential services that invoke the affected base.c functions.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["use-after-free","privilege-escalation","race-condition","local-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:04:56.588Z"}}