CVE-2026-20582
MediumCVSS 6.7Summary
In the USB component, there is a double-free vulnerability leading to memory corruption. It could enable local privilege escalation for an actor who already holds System privileges.
Risk Assessment
An attacker with System privileges could exploit the memory corruption to escalate privileges. The lack of required user interaction increases risk in high-trust environments.
Recommendation
Deploy patch ALPS11411924. Audit System privileges and limit the ability to run untrusted privileged processes.
Other vulnerabilities in USB
See all- CVE-2026-20584Medium
In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
- CVE-2026-20583Medium
In the USB component, there is a use-after-free vulnerability that could lead to a system crash. Exploitation requires System privileges but no user interaction.
- CVE-2026-20581Medium
In the USB component, there is a use-after-free vulnerability causing memory corruption. It could lead to local privilege escalation by an actor who already has System privileges.
- CVE-2026-20580Medium
In the USB component, there is a use-after-free vulnerability that could cause a system crash. Exploitation requires System privileges and no user interaction.
Original NVD description (English source)
In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS