CVE-2025-20787
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the display component, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.
Risk Assessment
Risk of local privilege escalation, potentially allowing an attacker to gain control.
Recommendation
Apply patch ALPS10149879 or update the system to a patched version.
Other vulnerabilities in display
See all- CVE-2026-20533Medium
In the display module, there is a possible escalation of privilege due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not required for exploitation.
- CVE-2026-20530Medium
In the display module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not required for exploitation.
- CVE-2026-20489Medium
In the display module, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.
- CVE-2026-20488Medium
In the display module, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.
- CVE-2026-20477Medium
In the display component, a missing bounds check could lead to an out-of-bounds write, allowing local escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20475Medium
In the display component, a missing bounds check could lead to an out-of-bounds write, allowing local escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20474Medium
In the display component, a race condition could lead to escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20473Medium
In the display component, there is a potential memory corruption due to use after free. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.
- CVE-2025-20786Medium
In the display component, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.
- CVE-2025-20785Medium
In the display component, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.
Original NVD description (English source)
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10149879; Issue ID: MSV-4658.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

