CVE-2026-20524

HighCVSS 8.4/10Last modified Oct 8, 2026

Description

In apu, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249004; Issue ID: MSV-9170.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1285

Affected software

No affected versions have been published.

Timeline

Published
Oct 5, 2026
Last modified
Oct 8, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-205255.3In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecCVE-2026-205267.5In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE CVE-2026-205275.3In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedCVE-2026-205286.7In ccci, there is a possible out of bounds write and read due to a missing bounds check. This could lead to local information disclosure, meCVE-2026-205296.7In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malCVE-2026-205310.0The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controCVE-2026-205306.7In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malCVE-2026-205318.4In apu, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with no additional exeCVE-2026-205326.2In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution prCVE-2026-205336.7In display, there is a possible escalation of privilege due to an integer overflow. This could lead to local escalation of privilege if a maCVE-2026-205345.3In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has CVE-2026-205356.7In aidl, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if
CVE-2026-20524: High severity, CVSS 8.4 | Vulnix