CVE-2026-56887: Buffer Overflow

Q: Who is exposed to this issue?

The affected code is in the Goodix G7 Trusted Execution Environment component on Android. The provided data does not identify specific Android versions, device models, or build identifiers.

Q: What does an attacker need to exploit it?

Exploitation is described as local and does not require user interaction or additional execution privileges. The issue could allow local escalation of privilege through a heap buffer overflow.

Q: How can I determine whether a device is affected?

Check whether the device includes the Goodix G7 component and the referenced gf_tee_internal_api.c implementation. The available information does not provide fixed versions or patch-level identifiers.

Published Nov 1, 2026

Updated

In gfvalidatecalibrationpackage of trusty/vendor/goodix/g7/goodix/main/gfteeinternalapi.c, there is a possible Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

1 affected componentFixes available

android/:unknown:>=Pixel-family specific:0<Pixel-family specific:2026-11-05

Pixel-family specific:2026-11-05

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

The affected code is in the Goodix G7 Trusted Execution Environment component on Android. The provided data does not identify specific Android versions, device models, or build identifiers.

What does an attacker need to exploit it?

Exploitation is described as local and does not require user interaction or additional execution privileges. The issue could allow local escalation of privilege through a heap buffer overflow.

How can I determine whether a device is affected?

Check whether the device includes the Goodix G7 component and the referenced gf_tee_internal_api.c implementation. The available information does not provide fixed versions or patch-level identifiers.

CVE-2026-56887: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether a device is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether a device is affected?