CVE-2026-56879: Medium severity N/A gmc_mba.c (gmc_mb_msg_handler) vulnerability
Published Sep 1, 2026
·Updated
In gmcmbmsghandler of gmcmba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Software
3 affected componentsFixes available
N/A gmc_mba.c (gmc_mb_msg_handler)
Google Android
android/:unknown:>=Pixel-family specific:0<Pixel-family specific:2026-09-05
Pixel-family specific:2026-09-05
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in Pixel-family specific:2026-09-05
Event History
Sep 1, 2026
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software
Sep 15, 2026
CVE Published
via MITRE·06:33 PM
Data Sourced
via MITRE·06:33 PM
DescriptionWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Is this exploitable over the network?
No. The CVSS vector is local (AV:L), so exploitation requires local access to the affected system.
2
What access does an attacker need before attempting exploitation?
The CVSS vector specifies high privileges required (PR:H). No user interaction is required.
3
What is the potential impact if exploitation succeeds?
The CVSS vector rates confidentiality, integrity, and availability impacts as high. The described outcome is local privilege escalation with System execution privileges.