CVE-2026-56936

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: Google Devices

Description

In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-56936

EUVD

EUVD-2026-93788

Affected Vendors & Products

Vendor	Product	Version / Range
Google	Android	Android kernel

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is in the wacom_hid_set_device_mode function of wacom_sys.c. It involves a missing bounds check that could allow an out-of-bounds write. This could lead to physical privilege escalation without needing additional execution privileges or user interaction.

Detection Guidance

This vulnerability is specific to the Linux kernel's Wacom HID driver (wacom_sys.c) and requires local access to exploit. Detection involves checking kernel versions and driver code for the affected function. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to gain elevated physical access privileges on a device. Since no additional execution privileges or user interaction are needed, it may be exploited remotely or locally with minimal effort.

Compliance Impact

The vulnerability involves a possible out-of-bounds write due to missing bounds check, potentially leading to privilege escalation. This could impact compliance by enabling unauthorized access or data manipulation, which may violate confidentiality and integrity requirements in standards like GDPR and HIPAA.

Mitigation Strategies

Apply the latest security patches or updates for the affected Wacom device drivers or firmware. Monitor vendor advisories for specific remediation steps. Since this is an Android-related issue, check for system updates from Google or your device manufacturer.

Hi! I’m here to help you understand CVE-2026-56936. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70