CVE-2025-20779
HighSummary
In the display module, a use-after-free vulnerability exists due to a race condition. This could lead to local privilege escalation if an attacker has already obtained System privilege. User interaction is not required for exploitation.
Risk Assessment
The risk to the organization is the potential for privilege escalation by malicious software or a local actor, which could lead to full device compromise. Prior acquisition of System privilege is required, which limits the risk, but it remains a serious threat.
Recommendation
It is recommended to immediately apply the patch ALPS10184084 (Issue ID: MSV-4720) provided by the vendor. Additionally, regularly update device software to minimize the risk of similar vulnerabilities.
Other vulnerabilities in Display
See all- CVE-2025-20780High
In the display module, there is a possible memory corruption due to use-after-free. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.
- CVE-2025-20778High
In the display module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation if an attacker has already obtained System privilege. User interaction is not required for exploitation.
- CVE-2026-20489Medium
In the display module, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.
- CVE-2026-20488Medium
In the display module, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.
- CVE-2026-20477Medium
In the display component, a missing bounds check could lead to an out-of-bounds write, allowing local escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20475Medium
In the display component, a missing bounds check could lead to an out-of-bounds write, allowing local escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20474Medium
In the display component, a race condition could lead to escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20473Medium
In the display component, there is a potential memory corruption due to use after free. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.
Original NVD description (English source)
In display, there is a possible use after free due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184084; Issue ID: MSV-4720.