# CVE-2026-59575: Google Pixel out of bounds write in NCI observe mode suspend

Source: https://junglewise.ai/threats/cve-2026-59575-in-stpropnci-cb-observe-mode-suspend-of-stpropnci-prop-android-cc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-59575 · Severity: info · Published 2026-11-10

A flaw in Google Pixel device firmware allows a local attacker to write data outside intended memory boundaries in the NCI (NFC Controller Interface) subsystem, causing the device to crash or become unresponsive. No special permissions or user interaction are required to trigger the vulnerability.

Technologies: [Google Pixel](https://junglewise.ai/threats/technologies/google-pixel). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-59575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59575 being exploited in the wild.

**How severe is CVE-2026-59575?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Google Pixel.

**Is there a fix for CVE-2026-59575?** Yes: fixed in Pixel security patch level 2026-11-05 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59575 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-59575?** Check whether you run Google Pixel. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Pixel security patch level 2026-11-05 or later

## Technical details

An out of bounds write vulnerability exists in stpropnci_cb_observe_mode_suspend of stpropnci_prop_android.cc due to missing bounds checking. A local attacker can trigger this condition to corrupt global state in the NCI firmware component, leading to denial of service. The vulnerability requires no additional execution privileges.

## Affected products

- Google Pixel

## Timeline

- 2026-11-10: disclosed

## References

- [https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01](https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01)

## Related threats

- [Google Pixel coprocessor memory privilege escalation](https://junglewise.ai/threats/cve-2026-95404-in-multiple-locations-there-is-a-possible-way-to-modify)
- [Google Pixel shared memory bitmap out-of-bounds write](https://junglewise.ai/threats/cve-2026-95403-in-multiple-locations-there-is-a-possible-way-to-trigger-an-out)
- [Google Pixel HWCodec buffer overflow in HEVC decoder](https://junglewise.ai/threats/cve-2026-95402-in-slice-header-of-hevc-decoder-there-is-a-possible-non-heap)
- [Google Pixel hevc_decoder buffer overflow](https://junglewise.ai/threats/cve-2026-95401-in-knee-function-info-of-hevc-decoder-there-is-a-possible-non)
- [Google Pixel FaceAuth race condition in biometric enrollment](https://junglewise.ai/threats/cve-2026-95399-in-multiple-functions-of-face-status-h-there-is-a-possible-way-to)