CVE-2026-26052

MediumCVSS 5.4/10Last modified Nov 11, 2026

Description

Insecure inherited permissions for some Intel(R) Graphics Driver software installers within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 4.0 5.4/10CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
n/aIntel(R) Graphics Driver software installersSee references

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-260535.3An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileCVE-2026-260546.8SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record usingCVE-2026-260557.5Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic ContCVE-2026-260568.8Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic ContCVE-2026-260579.1Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulCVE-2026-260586.1Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from thCVE-2026-260595.4ChurchCRM is an open-source church management system. In versions prior to 6.8.2, it was possible for an authenticated user with permission CVE-2026-26066.5IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) CVE-2026-260608.8Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previouslCVE-2026-260617.5Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request CVE-2026-260626.5Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC LaunchCVE-2026-260638.8CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input
CVE-2026-26052: Medium severity, CVSS 5.4 | Vulnix