CVE-2026-20567
MediumCVSS 6.7Summary
In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
Risk Assessment
A local attacker with System privileges could exploit the out-of-bounds write to escalate privileges. This poses a risk to devices running the unpatched afe component.
Recommendation
Apply the update containing patch ALPS11431394. Verify the afe component version and prioritize deployment on exposed devices.
Other vulnerabilities in afe
See all- CVE-2026-20576Medium
In the afe component, there is an out-of-bounds write vulnerability due to a missing bounds check. It could lead to local privilege escalation by an actor who already has System privileges.
- CVE-2026-20575Medium
In the afe component, there is a use-after-free vulnerability causing memory corruption. It could lead to local privilege escalation by an actor who already has System privileges.
- CVE-2026-20574Medium
In the afe component, there is a use-after-free vulnerability leading to memory corruption. It could enable local privilege escalation for an actor who already holds System privileges.
- CVE-2026-20573Medium
In the afe component, there is a double-free vulnerability causing memory corruption. It could lead to local privilege escalation by an actor who already has System privileges.
- CVE-2026-20571Medium
In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
- CVE-2026-20568Medium
In afe, there is a possible system crash due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
Original NVD description (English source)
In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-10004.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS