CVE-2026-15418
LowCVSS 2.4Summary
The silabser.sys driver for CP210x devices v11.5.0 and earlier allows a local unprivileged user with a malicious device to use malformed packets to leak up to 145 bytes of uninitialized kernel pool memory. This affects Windows 10 and earlier.
Risk Assessment
A local unprivileged user can disclose uninitialized kernel memory contents, potentially leading to sensitive information leakage. This requires local access and a malicious device.
Recommendation
Upgrade the silabser.sys driver for CP210x devices to a version later than 11.5.0 once available. Until patched, restrict the ability to connect untrusted CP210x devices to systems.
Other vulnerabilities in silabser.sys
See all- CVE-2026-15419High
In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memory, resulting in arbitrary code execution with escalated privileges.
- CVE-2026-15417Medium
The silabser.sys driver for CP210x devices on Windows 8 allows a local unprivileged user to use incorrect driver settings to cause a kernel crash.
Original NVD description (English source)
In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of uninitialized kernel pool memory. This vulnerability affects Windows 10 and earlier.