CVE-2026-20474
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the display component, a race condition could lead to escalation of privilege if the attacker already has System privilege. No user interaction is needed.
Risk Assessment
An attacker with System privileges could exploit the race condition to gain higher privileges, increasing the risk of full device control.
Recommendation
Apply patch ALPS11019183 which fixes the race condition.
Other vulnerabilities in display
See all- CVE-2025-20780High
In the display module, there is a possible memory corruption due to use-after-free. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.
- CVE-2025-20779High
In the display module, a use-after-free vulnerability exists due to a race condition. This could lead to local privilege escalation if an attacker has already obtained System privilege. User interaction is not required for exploitation.
- CVE-2025-20778High
In the display module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation if an attacker has already obtained System privilege. User interaction is not required for exploitation.
- CVE-2026-20489Medium
In the display module, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.
- CVE-2026-20488Medium
In the display module, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.
- CVE-2026-20477Medium
In the display component, a missing bounds check could lead to an out-of-bounds write, allowing local escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20475Medium
In the display component, a missing bounds check could lead to an out-of-bounds write, allowing local escalation of privilege if the attacker already has System privilege. No user interaction is needed.
- CVE-2026-20473Medium
In the display component, there is a potential memory corruption due to use after free. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.
Original NVD description (English source)
In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019183; Issue ID: MSV-7758.