Google Android kernel: Heap buffer overflow in FIPS HMAC handling
Summary
A missing bounds check in the handle_fips_hmac_req function of hwcrypto_proxy.c in the Android kernel can cause a heap buffer overflow. A local attacker with System-level execution privileges could use this to escalate privileges. No user interaction is required. Google rates the issue Critical in its Pixel bulletin, while the CVSS score of 6.7 (Medium) is provisional.
Affected
- Google Android kernel (per CVE record; affected Android kernel versions not specified)
- Google Pixel devices: device list not published for this CVE; coverage reports indicate Pixel 6a and newer, but check Google's device list
- Other Android OEMs: Unknown.
Fixed in
- Pixel security patch level 2026-11-05 or later (Pixel Update Bulletin, November 2026)
- Other Android OEMs: Unknown.
Workaround
- No vendor workaround documented.
- Applying the security patch level 2026-11-05 or later is the only verified mitigation.
Exploitation
- No known exploitation reported.
- No public proof-of-concept found.
- Not listed in the CISA KEV catalogue according to one aggregator; the catalogue was not checked directly.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Update all managed Pixel devices to security patch level 2026-11-05 or later; the rollout is phased, so verify the patch level on each device.
- Enforce updates through mobile device management (MDM).
- Restrict installation of untrusted apps, because local privilege escalation requires code running on the device.
- Check Google's device list to confirm coverage for each model before assuming it is patched.
- Keep Android devices on supported builds.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-56911 www.cve.org
- Google Pixel Update Bulletin, November 2026 source.android.com
- OSV entry PUB-A-508727728 osv.dev
- OffSeq Threat Radar (aggregator) radar.offseq.com
- Strix CVE entry (aggregator) www.strix.ai
- Gadget Hacks: November 2026 Pixel update android.gadgethacks.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:26.
Original description (NVD)
In handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.