CVE-2025-20778
HighSummary
In the display module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation if an attacker has already obtained System privilege. User interaction is not required for exploitation.
Risk Assessment
The risk involves potential privilege escalation within the system, which could allow an attacker to gain full control of the device. Prior possession of System privileges is required, which limits the attack scenario, but it remains a serious threat.
Recommendation
It is recommended to immediately apply the patch ALPS10184870 provided by the vendor. Also, restrict granting System privileges to trusted applications only and monitor the system for suspicious activities.
Other vulnerabilities in Display
See all- CVE-2025-20780High
In the display module, there is a possible memory corruption due to use-after-free. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.
- CVE-2025-20779High
In the display module, a use-after-free vulnerability exists due to a race condition. This could lead to local privilege escalation if an attacker has already obtained System privilege. User interaction is not required for exploitation.
- CVE-2026-20489Medium
In the display module, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.
- CVE-2026-20488Medium
In the display module, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.
- CVE-2026-20477Medium
In the display component, a missing bounds check could lead to an out-of-bounds write, allowing local escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20475Medium
In the display component, a missing bounds check could lead to an out-of-bounds write, allowing local escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20474Medium
In the display component, a race condition could lead to escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20473Medium
In the display component, there is a potential memory corruption due to use after free. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.
Original NVD description (English source)
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184870; Issue ID: MSV-4729.