CVE-2026-20542
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the apusys component, there is a possible memory corruption due to use after free. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.
Risk Assessment
Risk of local privilege escalation, potentially allowing full device compromise.
Recommendation
Apply patch ALPS11076799 (Issue ID: MSV-8143) as soon as possible.
Other vulnerabilities in apusys
See all- CVE-2026-20468Medium
In the apusys component, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.
- CVE-2026-20467Medium
In the apusys component, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.
- CVE-2025-20745Medium
In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained System privilege, with no user interaction needed.
Original NVD description (English source)
In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11076799; Issue ID: MSV-8143.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS