{"id":"CVE-2026-58829","published":"2026-11-02T20:17:47.940","lastModified":"2026-11-03T05:18:46.173","description":"In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://android.googlesource.com/kernel/common/+/517040c192cebb334766f43604e6a7ebb79d43ae","tags":[]},{"url":"https://android.googlesource.com/kernel/common/+/984713cde654f06871c542c469e3c226c8a79d9b","tags":[]},{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability in fuse_backing_mmap() allows an unprivileged local attacker to corrupt memory after the underlying object has been freed, potentially leading to privilege escalation without user interaction.","exploitability":"Exploitation requires local access and no privileges; the lack of user interaction and low attack complexity (AV:L/AC:L/PR:N) makes it highly exploitable by a local attacker.","blast_radius":"Successful exploitation could grant an unprivileged local user full system compromise (C:H/I:H/A:H), enabling complete control over the affected host.","remediation":"Upgrade to FUSE version 2.590 or later, as this release includes the fix for CVE-2026-58829.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["use-after-free","local-privilege-escalation","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:05:04.724Z"}}