CVE-2026-56945
HighCVSS 7.8Summary
In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Risk Assessment
The vulnerability may allow a local attacker to escalate privileges on the system, posing a risk of escalation to administrative level. The lack of required user interaction facilitates exploitation by malicious applications.
Recommendation
Immediately install available security patches for the VPU module. Also restrict the ability to run untrusted applications on the device.
Other vulnerabilities in VPU
See all- CVE-2026-56982Unknown
In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local privilege escalation with System execution privileges needed. User interaction is not required for exploitation.
- CVE-2026-56907Unknown
In VPU, there is a possible shared memory overwrite due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-55351High
In VPU, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-0197Medium
In VPU, an information disclosure is possible due to a logic error in the code. This could lead to local information disclosure requiring System execution privileges.
Original NVD description (English source)
In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.