CVE-2025-20745
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained System privilege, with no user interaction needed.
Risk Assessment
This could allow an attacker to gain higher privileges in the system, posing a serious security threat.
Recommendation
Apply the vendor patch ALPS10095441 to fix the use-after-free vulnerability in the apusys module.
Other vulnerabilities in apusys
See all- CVE-2026-20542Medium
In the apusys component, there is a possible memory corruption due to use after free. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.
- CVE-2026-20468Medium
In the apusys component, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.
- CVE-2026-20467Medium
In the apusys component, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.
Original NVD description (English source)
In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10095441; Issue ID: MSV-4294.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS