{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Google heeft kwetsbaarheden verholpen in Android.\n\nSamsung heeft de voor Samsung Mobile relevante kwetsbaarheden verholpen in hun producten.", "title": "Feiten" }, { "category": "description", "text": "De ernstige kwetsbaarheden betreffen onder andere mogelijkheden voor het uitvoeren van willekeurige code op afstand (Remote Code Execution) en het verkrijgen van verhoogde systeemrechten (Privilege Escalation). Hierdoor kunnen aanvallers ongeautoriseerde toegang krijgen tot systeemonderdelen en de controle over het apparaat verkrijgen. Er zijn op dit moment geen berichten bekend over actief misbruik van deze kwetsbaarheden.", "title": "Interpretaties" }, { "category": "description", "text": "Google heeft beveiligingsupdates uitgebracht om de kwetsbaarheden in Android-versies 14, 15, 16 en 17 te verhelpen.\n\nSamsung heeft daarnaast beveiligingsupdates beschikbaar gesteld om de relevante kwetsbaarheden in Samsung Galaxy-apparaten te verhelpen.\n\nRaadpleeg de onderstaande referenties voor meer informatie en de beschikbare beveiligingsupdates.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an SQL Command", "title": "CWE-89" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory", "title": "CWE-22" }, { "category": "general", "text": "Buffer Copy without Checking Size of Input", "title": "CWE-120" }, { "category": "general", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "general", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "general", "text": "Write-what-where Condition", "title": "CWE-123" }, { "category": "general", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "Improper Validation of Array Index", "title": "CWE-129" }, { "category": "general", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "general", "text": "Buffer Over-read", "title": "CWE-126" }, { "category": "general", "text": "Uncaught Exception", "title": "CWE-248" }, { "category": "general", "text": "Sensitive Information in Resource Not Removed Before Reuse", "title": "CWE-226" }, { "category": "general", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Double Free", "title": "CWE-415" }, { "category": "general", "text": "Use After Free", "title": "CWE-416" }, { "category": "general", "text": "Improper Verification of Cryptographic Signature", "title": "CWE-347" }, { "category": "general", "text": "Release of Invalid Pointer or Reference", "title": "CWE-763" }, { "category": "general", "text": "Improper Isolation or Compartmentalization", "title": "CWE-653" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://security.samsungmobile.com/securityUpdate.smsb" }, { "category": "external", "summary": "Reference", "url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01" } ], "title": "Kwetsbaarheden verholpen in Google Android en Samsung Mobile", "tracking": { "current_release_date": "2026-11-05T12:26:42.414881Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0467", "initial_release_date": "2026-11-05T12:26:42.414881Z", "revision_history": [ { "date": "2026-11-05T12:26:42.414881Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "Android" } ], "category": "vendor", "name": "Android" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "Android" } ], "category": "vendor", "name": "Samsung" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-0647", "cwe": { "id": "CWE-226", "name": "Sensitive Information in Resource Not Removed Before Reuse" }, "notes": [ { "category": "other", "text": "Sensitive Information in Resource Not Removed Before Reuse", "title": "CWE-226" }, { "category": "description", "text": "Certain Arm CPUs exhibit an issue where executing a CPP RCTX instruction on one Processing Element can block TLB invalidation during a TLBI, causing retention of stale TLB entries.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2025-0647 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-0647.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "baseScore": 7.9, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2025-0647" }, { "cve": "CVE-2025-22424", "notes": [ { "category": "description", "text": "Improper input validation in multiple locations can allow users to access images across accounts, potentially leading to local privilege escalation, though exploitation requires user interaction and no additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2025-22424 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22424.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2025-22424" }, { "cve": "CVE-2025-22426", "notes": [ { "category": "description", "text": "A logic error in multiple functions of ComputerEngine.java allows unauthorized cross-user URI access, potentially enabling local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2025-22426 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22426.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2025-22426" }, { "cve": "CVE-2025-22436", "cwe": { "id": "CWE-451", "name": "User Interface (UI) Misrepresentation of Critical Information" }, "notes": [ { "category": "other", "text": "User Interface (UI) Misrepresentation of Critical Information", "title": "CWE-451" }, { "category": "description", "text": "A tapjacking/overlay vulnerability allows attackers to trick users into revealing Autofill data, potentially enabling local privilege escalation without extra execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2025-22436 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22436.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2025-22436" }, { "cve": "CVE-2025-22442", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization", "title": "CWE-362" }, { "category": "description", "text": "A race condition in DevicePolicyManagerService.java enables unauthorized app installation in new work profiles, leading to local privilege escalation without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2025-22442 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22442.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2025-22442" }, { "cve": "CVE-2025-26433", "cwe": { "id": "CWE-451", "name": "User Interface (UI) Misrepresentation of Critical Information" }, "notes": [ { "category": "other", "text": "User Interface (UI) Misrepresentation of Critical Information", "title": "CWE-451" }, { "category": "description", "text": "A tapjacking/overlay attack can deceive users into granting permissions, enabling local privilege escalation without extra execution privileges, but requires user interaction for exploitation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2025-26433 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-26433.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2025-26433" }, { "cve": "CVE-2025-38627", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple vulnerabilities in the Linux kernel and AppArmor LSM, including use-after-free bugs in f2fs and critical flaws in AMD Zen processors, were fixed to prevent privilege escalation, denial of service, information exposure, and container escape across various architectures.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38627 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38627.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2025-38627" }, { "cve": "CVE-2025-48600", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing permission check in multiple files allows local users to disclose information across user boundaries without requiring additional privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2025-48600 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48600.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2025-48600" }, { "cve": "CVE-2026-0053", "notes": [ { "category": "description", "text": "An Android vulnerability allows a primary user to disable secure NFC for other full users due to insufficient user isolation, enabling local privilege escalation without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-0053 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0053.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-0053" }, { "cve": "CVE-2026-6726", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type" }, "notes": [ { "category": "other", "text": "Access of Resource Using Incompatible Type", "title": "CWE-843" }, { "category": "other", "text": "Use of Uninitialized Resource", "title": "CWE-908" }, { "category": "other", "text": "Incorrect Type Conversion or Cast", "title": "CWE-704" }, { "category": "description", "text": "Multiple vulnerabilities affect TPM 2.0 reference code and certain HPE servers with Intel processors, enabling local attackers with elevated privileges to spoof TPM attestations, obtain falsified credentials, and escalate privileges.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-6726 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6726.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C", "baseScore": 7.9, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-6726" }, { "cve": "CVE-2026-9034", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A Use After Free vulnerability in Arm Ltd's Bifrost, Valhall, and 5th Gen GPU Architecture userspace drivers allows non-privileged processes to access freed memory via GPU operations like WebGL or WebGPU.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-9034 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9034.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-9034" }, { "cve": "CVE-2026-9040", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization", "title": "CWE-362" }, { "category": "description", "text": "A race condition vulnerability in Arm Ltd's Bifrost, Valhall, and 5th Gen GPU Kernel Drivers enables local non-privileged users to cause denial of service or leak sensitive information via improper GPU memory operations.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-9040 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9040.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-9040" }, { "cve": "CVE-2026-11891", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A Use After Free vulnerability in Arm Ltd Valhall and 5th Gen GPU Userspace Drivers allows non-privileged processes, including WebGL/WebGPU users, to access freed memory across multiple driver versions from r46p0 to r55p0.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-11891 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-11891.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.1, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-11891" }, { "cve": "CVE-2026-15466", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A race condition in GPU system calls by non-privileged software can cause use-after-free vulnerabilities through improper handling of hardware performance counter destruction, potentially allowing unauthorized kernel heap memory access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-15466 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15466.json" } ], "title": "CVE-2026-15466" }, { "cve": "CVE-2026-16280", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "An integer overflow in calculating physical offsets for sparse PMRs larger than 4 GB can lead to incorrect GPU MMU mappings, enabling unauthorized users to access unintended physical memory and cause memory corruption or data leakage.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-16280 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16280.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-16280" }, { "cve": "CVE-2026-18629", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "A web page containing unusual GPU shader code can trigger integer overflow during GPU compiler memory allocation, causing NULL pointer dereference and crashes that may lead to device failures or exploits on privileged platforms.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-18629 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18629.json" } ], "title": "CVE-2026-18629" }, { "cve": "CVE-2026-19199", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "A 32-bit integer overflow in the KM driver leads to undersized kernel buffer allocation, enabling non-privileged software to map sensitive kernel data into an attacker-controlled GPU MMU context.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-19199 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-19199.json" } ], "title": "CVE-2026-19199" }, { "cve": "CVE-2026-20499", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in the modem firmware can lead to an out-of-bounds write, enabling remote privilege escalation if a user equipment connects to a malicious base station without user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20499 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20499.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20499" }, { "cve": "CVE-2026-20519", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in the Modem firmware can lead to an out-of-bounds write, enabling remote privilege escalation if a user equipment connects to a malicious base station.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20519 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20519.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20519" }, { "cve": "CVE-2026-20520", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in the modem firmware can lead to an out-of-bounds write, enabling remote privilege escalation if a user equipment connects to a malicious base station without user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20520 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20520.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20520" }, { "cve": "CVE-2026-20521", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "A missing bounds check vulnerability in Video HAL (Patch ID ALPS11375674, Issue ID MSV-9571) can lead to local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20521 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20521.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20521" }, { "cve": "CVE-2026-20522", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in Neuropilot leads to an out-of-bounds write vulnerability, enabling local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20522 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20522.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20522" }, { "cve": "CVE-2026-20523", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in Neuropilot leads to an out-of-bounds write vulnerability, enabling local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20523 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20523.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20523" }, { "cve": "CVE-2026-20524", "cwe": { "id": "CWE-1285", "name": "Improper Validation of Specified Index, Position, or Offset in Input" }, "notes": [ { "category": "other", "text": "Improper Validation of Specified Index, Position, or Offset in Input", "title": "CWE-1285" }, { "category": "description", "text": "A memory corruption vulnerability in apu caused by improper input validation can lead to local privilege escalation without user interaction, addressed by Patch ID ALPS11249004 (Issue ID MSV-9170).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20524 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20524.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20524" }, { "cve": "CVE-2026-20525", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "description", "text": "A system crash vulnerability in the Modem component caused by improper input validation can result in remote denial of service when a UE connects to a rogue base station, identified by Patch IDs MOLY01870473 / MOLY00814393 and Issue ID MSV-9041.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20525 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20525.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20525" }, { "cve": "CVE-2026-20526", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in the Modem can lead to an out-of-bounds write, enabling remote privilege escalation if a user equipment connects to a rogue base station, requiring user interaction for exploitation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20526 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20526.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20526" }, { "cve": "CVE-2026-20527", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "other", "text": "Improper Validation of Array Index", "title": "CWE-129" }, { "category": "description", "text": "A missing bounds check in the modem firmware can cause a system crash, enabling remote denial of service when a user equipment connects to a rogue base station without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20527 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20527.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20527" }, { "cve": "CVE-2026-20545", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in the Modem can lead to an out-of-bounds write, enabling remote privilege escalation when a UE connects to a rogue base station without user interaction or extra privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20545 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20545.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20545" }, { "cve": "CVE-2026-20546", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A vulnerability in a modem's out-of-bounds write due to improper bounds checking can enable remote privilege escalation when a user equipment connects to a rogue base station without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20546 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20546.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20546" }, { "cve": "CVE-2026-20547", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in the Modem component can lead to an out-of-bounds write, enabling remote privilege escalation when a user equipment connects to a rogue base station without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20547 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20547.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20547" }, { "cve": "CVE-2026-20548", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An integer overflow vulnerability in the Modem can lead to an out-of-bounds write, enabling remote privilege escalation without user interaction if a user equipment connects to a malicious base station.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20548 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20548.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20548" }, { "cve": "CVE-2026-20549", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A vulnerability in the Modem component allows out-of-bounds write due to improper input validation, enabling remote privilege escalation without user interaction when a UE connects to a rogue base station.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20549 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20549.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20549" }, { "cve": "CVE-2026-20553", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in DA can lead to an out-of-bounds write, enabling local privilege escalation if an attacker has physical access and no additional user interaction or execution privileges are required.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20553 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20553.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20553" }, { "cve": "CVE-2026-20554", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in the modem firmware can lead to system crashes and remote privilege escalation when a user equipment connects to a rogue base station, requiring user interaction for exploitation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20554 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20554.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20554" }, { "cve": "CVE-2026-20555", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "A missing bounds check in the Modem can lead to an out-of-bounds read, enabling a remote denial of service when a UE connects to a rogue base station without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20555 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20555.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20555" }, { "cve": "CVE-2026-20556", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in the Modem firmware can lead to an out-of-bounds write, enabling remote privilege escalation if a user equipment connects to a malicious base station.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20556 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20556.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20556" }, { "cve": "CVE-2026-20557", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in the modem firmware can lead to an out-of-bounds write, enabling remote privilege escalation if a user equipment connects to a malicious base station without user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20557 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20557.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20557" }, { "cve": "CVE-2026-20558", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability in the GPU pdma component allows local privilege escalation without additional execution privileges or user interaction, addressed by Patch ID ALPS11365070.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20558 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20558.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20558" }, { "cve": "CVE-2026-20559", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability in the GPU pdma component can lead to memory corruption, enabling local privilege escalation without requiring user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20559 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20559.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20559" }, { "cve": "CVE-2026-20560", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "A system crash vulnerability in the Modem caused by improper input validation can be remotely exploited without user interaction if a UE connects to a rogue base station, potentially resulting in a denial of service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20560 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20560.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20560" }, { "cve": "CVE-2026-20561", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "A missing bounds check in the modem firmware can lead to an out-of-bounds write, enabling a remote denial of service attack via a rogue base station without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20561 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20561.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20561" }, { "cve": "CVE-2026-20562", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "other", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" }, { "category": "description", "text": "A missing bounds check in the modem firmware can lead to an out-of-bounds write, enabling a remote denial of service attack via a rogue base station without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20562 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20562.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20562" }, { "cve": "CVE-2026-20563", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A modem vulnerability due to an incorrect bounds check can lead to an out-of-bounds write, enabling a remote denial of service attack via a rogue base station without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20563 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20563.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20563" }, { "cve": "CVE-2026-20564", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A vulnerability in the Modem caused by an incorrect bounds check can lead to an out-of-bounds write, potentially resulting in a local denial of service without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20564 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20564.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20564" }, { "cve": "CVE-2026-20565", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A vulnerability in a modem's bounds checking mechanism can lead to an out-of-bounds write, enabling local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20565 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20565.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20565" }, { "cve": "CVE-2026-20586", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A missing bounds check in the video decoder (vdec) can lead to an out-of-bounds write, enabling remote privilege escalation that requires user interaction but no additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20586 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20586.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20586" }, { "cve": "CVE-2026-20589", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A type confusion vulnerability in the venc component can lead to an out-of-bounds write, potentially enabling local privilege escalation if the attacker already possesses System privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-20589 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20589.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.7, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-20589" }, { "cve": "CVE-2026-22165", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A web page containing unusual WebGPU content can trigger a write use-after-free vulnerability in the GPU GLES user-space library, potentially enabling further exploits on devices where the graphics process operates with system privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-22165 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22165.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-22165" }, { "cve": "CVE-2026-23184", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "The Linux kernel addressed a use-after-free vulnerability in binder_netlink_report() by implementing a transaction copy to safely handle data after a BR_TRANSACTION_PENDING_FROZEN error, preventing unsafe memory dereferencing.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-23184 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-23184.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-23184" }, { "cve": "CVE-2026-23240", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization", "title": "CWE-362" }, { "category": "description", "text": "Multiple SUSE Linux Enterprise Kernel updates address critical security vulnerabilities including TLS race conditions, VXLAN ND option validation, IPv6 ICMP skb clearing, KVM shadow paging use-after-free, and IPv4 fragmentation handling across versions 5.14 and 6.4.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-23240 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-23240.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-23240" }, { "cve": "CVE-2026-25285", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-25285 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25285.json" } ], "title": "CVE-2026-25285" }, { "cve": "CVE-2026-25286", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-25286 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25286.json" } ], "title": "CVE-2026-25286" }, { "cve": "CVE-2026-25287", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-25287 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25287.json" } ], "title": "CVE-2026-25287" }, { "cve": "CVE-2026-25291", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Memory corruption arises from insufficient synchronization during concurrent operations on shared memory page lists, leading to potential data integrity issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-25291 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25291.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-25291" }, { "cve": "CVE-2026-25301", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-25301 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25301.json" } ], "title": "CVE-2026-25301" }, { "cve": "CVE-2026-25302", "cwe": { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature" }, "notes": [ { "category": "other", "text": "Improper Verification of Cryptographic Signature", "title": "CWE-347" }, { "category": "description", "text": "A cryptographic vulnerability permits bypassing authentication and signature verification for non-ELF partitions, allowing unsigned or corrupted images to be mounted and processed.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-25302 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25302.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-25302" }, { "cve": "CVE-2026-28580", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input" }, "notes": [ { "category": "other", "text": "Buffer Copy without Checking Size of Input", "title": "CWE-120" }, { "category": "description", "text": "A vulnerability in NotificationChannel.java due to improper bounds checking can lead to persistence desynchronization, enabling local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28580 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28580.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28580" }, { "cve": "CVE-2026-28586", "notes": [ { "category": "description", "text": "AppOpsService.java contains multiple functions with missing permission checks that could lead to local information disclosure without requiring additional privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28586 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28586.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.3, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28586" }, { "cve": "CVE-2026-28588", "notes": [ { "category": "description", "text": "A logic error in ExternalStorageProvider.java's shouldBlockDirectoryFromTree method allows unauthorized access to protected data, enabling local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28588 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28588.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28588" }, { "cve": "CVE-2026-28597", "notes": [ { "category": "description", "text": "A permission bypass vulnerability in UriGrantsManagerService.java's writeGrantedUriPermissions allows local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28597 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28597.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28597" }, { "cve": "CVE-2026-28621", "notes": [ { "category": "description", "text": "The getRingtone method in RingtoneFactory.java lacks a permission check, potentially allowing unprivileged local users to disclose information without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28621 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28621.json" } ], "title": "CVE-2026-28621" }, { "cve": "CVE-2026-28632", "notes": [ { "category": "description", "text": "A logic error in the code permits file sharing across user profiles in multiple locations, leading to potential local information disclosure without requiring additional privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28632 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28632.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28632" }, { "cve": "CVE-2026-28643", "notes": [ { "category": "description", "text": "A missing permission check in multiple locations can lead to local denial of service without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28643 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28643.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28643" }, { "cve": "CVE-2026-28645", "notes": [ { "category": "description", "text": "A logic error in UsbService.java's onStrongAuthRequiredChanged function can enable USB data without authentication, causing physical privilege escalation without user interaction or elevated execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28645 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28645.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28645" }, { "cve": "CVE-2026-28665", "notes": [ { "category": "description", "text": "Improper input validation in SettingsApplication.java's onCreate method can lead to cross-profile consent dialog label injection, enabling local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28665 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28665.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28665" }, { "cve": "CVE-2026-31533", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "other", "text": "Release of Invalid Pointer or Reference", "title": "CWE-763" }, { "category": "description", "text": "Multiple security vulnerabilities including use-after-free, race conditions, out-of-bounds writes, and privilege escalation flaws were fixed across SUSE Linux Enterprise Kernel versions 5.14, 6.4, 6.12, and 15/16 releases, affecting networking, cryptographic, and device subsystems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-31533 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-31533.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-31533" }, { "cve": "CVE-2026-41155", "cwe": { "id": "CWE-653", "name": "Improper Isolation or Compartmentalization" }, "notes": [ { "category": "other", "text": "Improper Isolation or Compartmentalization", "title": "CWE-653" }, { "category": "description", "text": "An attacker can exploit shared secure memory allocations in the GPU kernel module to enable data leakage between secure GPU processes, potentially causing image corruption and hardware recovery issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-41155 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41155.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-41155" }, { "cve": "CVE-2026-43284", "cwe": { "id": "CWE-123", "name": "Write-what-where Condition" }, "notes": [ { "category": "other", "text": "Write-what-where Condition", "title": "CWE-123" }, { "category": "description", "text": "Multiple critical Linux kernel vulnerabilities including Dirty Frag and Fragnesia in XFRM ESP-in-TCP and RxRPC subsystems, along with other flaws in cryptographic APIs, networking, and drivers, were fixed across SUSE Linux Enterprise versions and AMD processors.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43284 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43284.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43284" }, { "cve": "CVE-2026-43499", "cwe": { "id": "CWE-825", "name": "Expired Pointer Dereference" }, "notes": [ { "category": "other", "text": "Expired Pointer Dereference", "title": "CWE-825" }, { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple critical security vulnerabilities affecting AMD processors and various Linux kernel subsystems—including architectures, drivers, filesystems, networking, and security modules—were identified and addressed to prevent privilege escalation, information leaks, and system compromise.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43499 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43499.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43499" }, { "cve": "CVE-2026-45199", "cwe": { "id": "CWE-823", "name": "Use of Out-of-range Pointer Offset" }, "notes": [ { "category": "other", "text": "Use of Out-of-range Pointer Offset", "title": "CWE-823" }, { "category": "description", "text": "Kernel software running inside a Guest VM can issue improper GPU commands causing out-of-bounds memory writes, which may lead to privilege escalation within the virtualized environment.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-45199 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45199.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-45199" }, { "cve": "CVE-2026-45201", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "other", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" }, { "category": "description", "text": "Improper validation of log2 page size in GPU system calls allows non-privileged software to perform out-of-bounds memory reads or writes by misinterpreting 4K pages as larger pages.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-45201 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45201.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-45201" }, { "cve": "CVE-2026-45204", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Non-privileged software making improper GPU system calls can cause out-of-bounds access and kernel null pointer dereference in error paths, resulting in kernel exceptions, platform instability, and denial of service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-45204 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45204.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-45204" }, { "cve": "CVE-2026-45514", "notes": [ { "category": "description", "text": "A logic error in multiple functions of SaveUi.java allows bypassing package installation requirements, enabling local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-45514 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45514.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-45514" }, { "cve": "CVE-2026-45522", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-45522 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45522.json" } ], "title": "CVE-2026-45522" }, { "cve": "CVE-2026-46232", "cwe": { "id": "CWE-805", "name": "Buffer Access with Incorrect Length Value" }, "notes": [ { "category": "other", "text": "Buffer Access with Incorrect Length Value", "title": "CWE-805" }, { "category": "description", "text": "Multiple security vulnerabilities affecting AMD Zen 2 processors, Linux kernel subsystems including PlayStation HID driver, ARM architectures, and various drivers were fixed to prevent privilege escalation, information disclosure, and speculative execution attacks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-46232 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-46232.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-46232" }, { "cve": "CVE-2026-46242", "cwe": { "id": "CWE-825", "name": "Expired Pointer Dereference" }, "notes": [ { "category": "other", "text": "Expired Pointer Dereference", "title": "CWE-825" }, { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple updates to SUSE Linux Enterprise kernels, including Micro, 15 SP6, 15 SP7, and 16.0 versions, addressed numerous critical security vulnerabilities across various subsystems, drivers, and architectures, notably fixing AMD Zen 2 processor flaws and a use-after-free issue in the eventpoll mechanism.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-46242 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-46242.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-46242" }, { "cve": "CVE-2026-49912", "notes": [ { "category": "description", "text": "A logic error in MediaCarouselController.kt can cause media to display after being disabled, potentially leading to local information disclosure without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-49912 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-49912.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-49912" }, { "cve": "CVE-2026-49922", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A permission bypass vulnerability in queryRemoteConnectionServices within ConnectionServiceWrapper.java enables local privilege escalation without requiring user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-49922 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-49922.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-49922" }, { "cve": "CVE-2026-49923", "cwe": { "id": "CWE-451", "name": "User Interface (UI) Misrepresentation of Critical Information" }, "notes": [ { "category": "other", "text": "User Interface (UI) Misrepresentation of Critical Information", "title": "CWE-451" }, { "category": "description", "text": "A logic error in AccountManagerService.java's onResult method can lead to an untrusted or misleading UI, enabling local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-49923 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-49923.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-49923" }, { "cve": "CVE-2026-49924", "notes": [ { "category": "description", "text": "A vulnerability in ShortcutInfo.java enables unauthorized shortcuts to exhaust system resources, potentially crashing the launcher and causing a local denial of service without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-49924 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-49924.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-49924" }, { "cve": "CVE-2026-49925", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-49925 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-49925.json" } ], "title": "CVE-2026-49925" }, { "cve": "CVE-2026-49931", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A vulnerability in onActivityResult across multiple locations can lead to a contact leak from a protected profile via a confused deputy, enabling local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-49931 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-49931.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-49931" }, { "cve": "CVE-2026-49934", "notes": [ { "category": "description", "text": "Multiple functions in MmiUtils.java exhibit improper input validation that may enable USSD/MMI code execution, potentially leading to local privilege escalation requiring user interaction for exploitation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-49934 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-49934.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-49934" }, { "cve": "CVE-2026-49935", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory", "title": "CWE-22" }, { "category": "description", "text": "A permission bypass vulnerability in LocaleManagerService.java's getXmlFileNameForUser method allows local information disclosure via a confusable path traversal without user interaction or extra privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-49935 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-49935.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-49935" }, { "cve": "CVE-2026-53256", "cwe": { "id": "CWE-364", "name": "Signal Handler Race Condition" }, "notes": [ { "category": "other", "text": "Signal Handler Race Condition", "title": "CWE-364" }, { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, drivers, and architectures—including critical CPU flaws in Arm and AMD processors—were fixed in SUSE Linux Enterprise Micro 6.0/6.1 and 15 SP6/SP7 kernels to prevent privilege escalation, denial of service, and memory protection bypasses.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-53256 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-53256.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-53256" }, { "cve": "CVE-2026-55257", "cwe": { "id": "CWE-451", "name": "User Interface (UI) Misrepresentation of Critical Information" }, "notes": [ { "category": "other", "text": "User Interface (UI) Misrepresentation of Critical Information", "title": "CWE-451" }, { "category": "description", "text": "A UI issue in UsbDialogHelper.java can lead to local privilege escalation without requiring additional execution privileges or user interaction, posing a significant security risk.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55257 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55257.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55257" }, { "cve": "CVE-2026-55261", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing permission check in the nfa_t4tnfcee_store_rx_buf function of nfa_nfcee_act.cc enables local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55261 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55261.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55261" }, { "cve": "CVE-2026-55262", "notes": [ { "category": "description", "text": "A local privilege escalation vulnerability exists in NotificationManagerService.java's setNotificationListenerAccessGrantedForUserInternal due to improper input validation causing policy desynchronization without requiring user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55262 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55262.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55262" }, { "cve": "CVE-2026-55263", "cwe": { "id": "CWE-451", "name": "User Interface (UI) Misrepresentation of Critical Information" }, "notes": [ { "category": "other", "text": "User Interface (UI) Misrepresentation of Critical Information", "title": "CWE-451" }, { "category": "description", "text": "AllowBindAppWidgetActivity.java contains multiple functions with misleading or insufficient UI that may cause users to misunderstand consent or rejection actions, potentially enabling local privilege escalation requiring user interaction but no additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55263 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55263.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55263" }, { "cve": "CVE-2026-55264", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A vulnerability in the checkWhetherCallingAppHasAccess method of DownloadProvider.java allows local information disclosure without requiring additional privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55264 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55264.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55264" }, { "cve": "CVE-2026-55271", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "The ContactsPickerActivity.kt file contains a potential intent redirection vulnerability in the forwardToPreferredActionPickHandler function, which may enable local privilege escalation without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55271 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55271.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55271" }, { "cve": "CVE-2026-55272", "notes": [ { "category": "description", "text": "A vulnerability in the loadDescription method of DeviceAdminAdd.java enables a local denial of service via improper input validation without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55272 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55272.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55272" }, { "cve": "CVE-2026-55275", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A race condition causing a use-after-free vulnerability in multiple locations can enable remote privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55275 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55275.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55275" }, { "cve": "CVE-2026-55283", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free memory safety vulnerability in multiple locations enables remote privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55283 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55283.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55283" }, { "cve": "CVE-2026-55287", "cwe": { "id": "CWE-451", "name": "User Interface (UI) Misrepresentation of Critical Information" }, "notes": [ { "category": "other", "text": "User Interface (UI) Misrepresentation of Critical Information", "title": "CWE-451" }, { "category": "description", "text": "A vulnerability in GrantCredentialsPermissionActivity.java's onCreate method may enable local privilege escalation without requiring additional execution privileges or user interaction due to misleading or insufficient user interface elements.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55287 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55287.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55287" }, { "cve": "CVE-2026-55288", "cwe": { "id": "CWE-248", "name": "Uncaught Exception" }, "notes": [ { "category": "other", "text": "Uncaught Exception", "title": "CWE-248" }, { "category": "description", "text": "A vulnerability in SIMRecords.java's validEfCfis method can trigger a denial of service via an uncaught exception, potentially enabling local privilege escalation without user interaction or elevated execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55288 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55288.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55288" }, { "cve": "CVE-2026-55289", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A confused deputy vulnerability in multiple functions allows execution of sensitive USSD codes, enabling local privilege escalation without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55289 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55289.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55289" }, { "cve": "CVE-2026-55292", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "An integer underflow vulnerability in rw_ci_data_cback of rw_ci.cc can lead to remote information disclosure without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-55292 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55292.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-55292" }, { "cve": "CVE-2026-57537", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Memory corruption arises from concurrent access and modification of geographic mapping data without adequate synchronization, leading to potential data integrity and stability issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-57537 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-57537.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-57537" }, { "cve": "CVE-2026-57545", "cwe": { "id": "CWE-822", "name": "Untrusted Pointer Dereference" }, "notes": [ { "category": "other", "text": "Untrusted Pointer Dereference", "title": "CWE-822" }, { "category": "description", "text": "Memory corruption arises from processing draw objects of an incorrect type during the execution of graphics command lists, potentially leading to instability or exploitation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-57545 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-57545.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-57545" }, { "cve": "CVE-2026-57546", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "other", "text": "Buffer Over-read", "title": "CWE-126" }, { "category": "description", "text": "A transient denial of service occurs during continuous receive command processing when a zero-sized global configuration override is applied, causing temporary service disruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-57546 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-57546.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-57546" }, { "cve": "CVE-2026-57547", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-57547 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-57547.json" } ], "title": "CVE-2026-57547" }, { "cve": "CVE-2026-57548", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-57548 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-57548.json" } ], "title": "CVE-2026-57548" }, { "cve": "CVE-2026-57549", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-57549 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-57549.json" } ], "title": "CVE-2026-57549" }, { "cve": "CVE-2026-57554", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Memory corruption arises from concurrent asynchronous thread access to shared performance counter data during FastRPC invocations, potentially leading to unstable system behavior.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-57554 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-57554.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-57554" }, { "cve": "CVE-2026-58814", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "A denial of service vulnerability caused by an integer overflow in the parseContentType function of PduParser.java allows remote exploitation without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58814 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58814.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58814" }, { "cve": "CVE-2026-58817", "notes": [ { "category": "description", "text": "A vulnerability in ParsingUtils.java's parseKnownActivityEmbeddingCerts function enables a permanent local denial of service via improper input validation without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58817 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58817.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58817" }, { "cve": "CVE-2026-58821", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an SQL Command", "title": "CWE-89" }, { "category": "description", "text": "SearchRequestDatabaseUtil.java contains multiple SQL injection vulnerabilities that can lead to unauthorized access to protected data and local denial of service without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58821 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58821.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58821" }, { "cve": "CVE-2026-58824", "notes": [ { "category": "description", "text": "An out-of-bounds write vulnerability in __pkvm_load_tracing of trace.c caused by an incorrect bounds check may enable local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58824 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58824.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58824" }, { "cve": "CVE-2026-58825", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A logic error in fork.c introduces a use-after-free vulnerability enabling local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58825 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58825.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58825" }, { "cve": "CVE-2026-58826", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability in the ksys_unshare function of fork.c can lead to memory corruption, enabling local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58826 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58826.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58826" }, { "cve": "CVE-2026-58827", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A race condition in multiple functions of dma-buf.c leads to use-after-free vulnerabilities, enabling local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58827 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58827.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58827" }, { "cve": "CVE-2026-58828", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A race condition in multiple functions of base.c leads to a use-after-free vulnerability that can enable local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58828 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58828.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58828" }, { "cve": "CVE-2026-58829", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability in fuse_backing_mmap of backing.c can lead to memory corruption, enabling local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58829 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58829.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58829" }, { "cve": "CVE-2026-58836", "notes": [ { "category": "description", "text": "A logic error in InstallPackageHelper.java's handlePackagePostInstall allows sideloaded apps to bypass Enhanced Confirmation Mode and alter package sources during self-update, enabling local privilege escalation without user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58836 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58836.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58836" }, { "cve": "CVE-2026-58837", "notes": [ { "category": "description", "text": "A logic error in the code can trigger unintended background activity launches, enabling local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58837 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58837.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58837" }, { "cve": "CVE-2026-58838", "notes": [ { "category": "description", "text": "Multiple functions in Helpers.java exhibit improper input validation, potentially leading to local information disclosure without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58838 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58838.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58838" }, { "cve": "CVE-2026-58844", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A vulnerability due to incorrect bounds checks in multiple locations can enable local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58844 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58844.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58844" }, { "cve": "CVE-2026-58845", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "An integer overflow vulnerability in multiple locations can lead to out-of-bounds writes, potentially enabling local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58845 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58845.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58845" }, { "cve": "CVE-2026-58847", "notes": [ { "category": "description", "text": "A logic error in the kvm_vfio_pviommu_attach function of vfio.c causes a double free vulnerability, enabling local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58847 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58847.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58847" }, { "cve": "CVE-2026-58853", "notes": [ { "category": "description", "text": "A stack buffer overflow vulnerability in multiple functions of ipphelper.c can enable remote denial of service without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58853 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58853.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58853" }, { "cve": "CVE-2026-58857", "notes": [ { "category": "description", "text": "A use-after-free vulnerability in CryptoHalHidl.cpp's decrypt function, caused by a race condition, enables remote code execution without requiring additional privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58857 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58857.json" } ], "title": "CVE-2026-58857" }, { "cve": "CVE-2026-58866", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing permission check in AccessibilityWindowManager.java's setAccessibilityWindowAttributes method can lead to an untrusted UI vulnerability, enabling local privilege escalation without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58866 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58866.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58866" }, { "cve": "CVE-2026-58867", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing permission check in the getMessenger method of WifiP2pServiceImpl.java can lead to local privilege escalation without requiring user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58867 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58867.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58867" }, { "cve": "CVE-2026-58868", "notes": [ { "category": "description", "text": "A heap buffer overflow vulnerability in FrameDecoder.cpp's onOutputReceived function can lead to out-of-bounds writes, potentially enabling remote code execution without additional privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58868 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58868.json" } ], "title": "CVE-2026-58868" }, { "cve": "CVE-2026-58870", "notes": [ { "category": "description", "text": "A missing permission check in the onPersistentGroupsChanged method of WifiP2pServiceImpl.java may lead to local information disclosure without requiring user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58870 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58870.json" } ], "title": "CVE-2026-58870" }, { "cve": "CVE-2026-58871", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "description", "text": "A heap buffer overflow in set_type4_frame_classifier of sta_iface.cpp can lead to a memory safety issue, potentially enabling local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58871 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58871.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58871" }, { "cve": "CVE-2026-58875", "notes": [ { "category": "description", "text": "The document details a local denial of service vulnerability arising from improper input validation in multiple locations, exploitable without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58875 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58875.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58875" }, { "cve": "CVE-2026-58876", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free memory safety vulnerability in multiple locations could enable remote code execution without requiring additional privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58876 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58876.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58876" }, { "cve": "CVE-2026-58877", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A permission bypass vulnerability in WifiP2pServiceImpl.java's checkNearbyDevicesPermission method can lead to local information disclosure without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58877 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58877.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58877" }, { "cve": "CVE-2026-58879", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A vulnerability in the descramble process of multiple files allows an out-of-bounds write via improper casting, potentially enabling local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58879 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58879.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58879" }, { "cve": "CVE-2026-58882", "notes": [ { "category": "description", "text": "An integer overflow vulnerability in decodeWapPdu of WapPushOverSms.java may cause an out-of-bounds read, potentially enabling remote denial of service without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58882 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58882.json" } ], "title": "CVE-2026-58882" }, { "cve": "CVE-2026-58883", "notes": [ { "category": "description", "text": "A logic error in the code can trigger a remote denial of service without requiring user interaction or elevated execution privileges, posing a significant risk to affected systems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58883 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58883.json" } ], "title": "CVE-2026-58883" }, { "cve": "CVE-2026-58884", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A permission bypass vulnerability in WifiServiceImpl.java's startTetheredHotspotRequest method allows local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58884 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58884.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58884" }, { "cve": "CVE-2026-58885", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A permission bypass vulnerability involving a confused deputy scenario enables local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58885 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58885.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58885" }, { "cve": "CVE-2026-58886", "notes": [ { "category": "description", "text": "A logic error in InputMonitor.java's updateInputWindows method introduces a tapjacking vulnerability that enables local privilege escalation through user interaction without requiring additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58886 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58886.json" } ], "title": "CVE-2026-58886" }, { "cve": "CVE-2026-58933", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "A logic error in C2SoftApvDec.cpp can cause an out-of-bounds read, potentially leading to remote information disclosure without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58933 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58933.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58933" }, { "cve": "CVE-2026-58934", "notes": [ { "category": "description", "text": "A logic error in the prepareWindowToDisplayDuringRelayout function of WindowState.java can lead to a permission bypass, enabling local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58934 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58934.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58934" }, { "cve": "CVE-2026-58936", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability in the png_set_tRNS function of pngset.c can lead to memory corruption and potentially enable remote code execution without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58936 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58936.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58936" }, { "cve": "CVE-2026-58937", "notes": [ { "category": "description", "text": "Multiple locations exhibit a persistent denial of service vulnerability due to improper input validation, enabling local denial of service without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58937 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58937.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58937" }, { "cve": "CVE-2026-58938", "notes": [ { "category": "description", "text": "A vulnerability in the parseChunk function of MPEG4Extractor.cpp allows remote denial of service via improper input validation without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58938 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58938.json" } ], "title": "CVE-2026-58938" }, { "cve": "CVE-2026-58942", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A logic error in the do_fault_around function of memory.c introduces a use-after-free vulnerability that may enable local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58942 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58942.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58942" }, { "cve": "CVE-2026-58943", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A vulnerability in AddAccountSettings.java enables a confused deputy attack, resulting in local privilege escalation without requiring user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58943 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58943.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58943" }, { "cve": "CVE-2026-58944", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A local privilege escalation vulnerability exists in the moveTaskToFrontLocked function of ActivityTaskManagerService.java, allowing elevation of privileges without user interaction or additional execution rights.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58944 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58944.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58944" }, { "cve": "CVE-2026-58945", "notes": [ { "category": "description", "text": "Improper cryptographic implementation in multiple locations leads to a side channel information leak that can expose paired device information without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58945 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58945.json" } ], "title": "CVE-2026-58945" }, { "cve": "CVE-2026-58946", "notes": [ { "category": "description", "text": "A logic error in the navigateUpTo method of ActivityClientController.java can cause a permission bypass, enabling local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58946 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58946.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58946" }, { "cve": "CVE-2026-58949", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "A stack buffer overflow vulnerability in the parseMetaData function of StagefrightMetadataRetriever.cpp can lead to a remote denial of service without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58949 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58949.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58949" }, { "cve": "CVE-2026-58951", "notes": [ { "category": "description", "text": "A missing permission check in multiple locations can lead to local information disclosure without requiring user interaction or elevated execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58951 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58951.json" } ], "title": "CVE-2026-58951" }, { "cve": "CVE-2026-58953", "notes": [ { "category": "description", "text": "A heap buffer overflow in dec_vlc_read of oapv_vlc.c leads to an out-of-bounds read, potentially enabling remote information disclosure without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58953 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58953.json" } ], "title": "CVE-2026-58953" }, { "cve": "CVE-2026-58955", "notes": [ { "category": "description", "text": "A logic error in the updateNotificationChannel method of PreferencesHelper.java can cause UI obfuscation, resulting in a local denial of service without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58955 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58955.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58955" }, { "cve": "CVE-2026-58956", "notes": [ { "category": "description", "text": "A logic error in the modpowF4 function of avb_rsa.c can enable signature verification bypass, potentially leading to local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58956 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58956.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58956" }, { "cve": "CVE-2026-58957", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A vulnerability in ActivityStarter.java's resolveToHeavyWeightSwitcherIfNeeded method enables background activity launches via a confused deputy, allowing local privilege escalation without user interaction or extra privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58957 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58957.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58957" }, { "cve": "CVE-2026-58958", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58958 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58958.json" } ], "title": "CVE-2026-58958" }, { "cve": "CVE-2026-58961", "notes": [ { "category": "description", "text": "A logic error in ActivityTaskManagerService.java's moveTaskToFrontLocked method permits background activity launches, enabling local privilege escalation without user interaction or extra execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58961 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58961.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58961" }, { "cve": "CVE-2026-58962", "notes": [ { "category": "description", "text": "A missing permission check in the moveTaskToFrontLocked method of ActivityTaskManagerService.java enables local privilege escalation without requiring user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58962 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58962.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58962" }, { "cve": "CVE-2026-58963", "notes": [ { "category": "description", "text": "The document details a remote denial of service vulnerability stemming from improper input validation that can be exploited without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58963 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58963.json" } ], "title": "CVE-2026-58963" }, { "cve": "CVE-2026-58964", "notes": [ { "category": "description", "text": "A permission bypass vulnerability in SmsUsageMonitor.java's checkDestination method enables local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58964 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58964.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58964" }, { "cve": "CVE-2026-58965", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A permission bypass vulnerability in MusicFxHelper.java's handleAudioEffectBroadcast method enables local privilege escalation without requiring user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58965 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58965.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58965" }, { "cve": "CVE-2026-58966", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "A stack buffer overflow in multiple functions of hppsfilter.c can lead to out-of-bounds writes, enabling local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58966 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58966.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58966" }, { "cve": "CVE-2026-58968", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "other", "text": "Double Free", "title": "CWE-415" }, { "category": "description", "text": "A double free vulnerability in the oapvd_vlc_metadata function of oapv_vlc.c can lead to memory corruption, potentially enabling remote privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58968 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58968.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58968" }, { "cve": "CVE-2026-58969", "notes": [ { "category": "description", "text": "MediaQualityService.java contains multiple functions lacking permission checks, potentially enabling local information disclosure without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58969 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58969.json" } ], "title": "CVE-2026-58969" }, { "cve": "CVE-2026-58970", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A vulnerability in AppTimeTracker.java's deliverResult method enables background activity launch via a confused deputy, potentially allowing local privilege escalation without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58970 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58970.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58970" }, { "cve": "CVE-2026-58971", "notes": [ { "category": "description", "text": "An integer overflow in _mupdf_get_hdr of wprint_mupdf.c can cause an out-of-bounds read, potentially leading to local information disclosure without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58971 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58971.json" } ], "title": "CVE-2026-58971" }, { "cve": "CVE-2026-58974", "notes": [ { "category": "description", "text": "A missing permission check in multiple locations can lead to local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58974 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58974.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58974" }, { "cve": "CVE-2026-58975", "notes": [ { "category": "description", "text": "A missing bounds check in multiple locations can lead to out-of-bounds writes, potentially enabling local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58975 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58975.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58975" }, { "cve": "CVE-2026-58976", "notes": [ { "category": "description", "text": "A logic error in the getSelectionBySubIds method of ProviderUtil.java can cause cross-user data leakage, resulting in local information disclosure without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58976 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58976.json" } ], "title": "CVE-2026-58976" }, { "cve": "CVE-2026-58977", "notes": [ { "category": "description", "text": "A missing bounds check in the is_valid_header function of timed_cache_item.c can lead to an out-of-bounds write, potentially enabling local privilege escalation without user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58977 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58977.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.7, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58977" }, { "cve": "CVE-2026-58978", "notes": [ { "category": "description", "text": "A logic error in the code permits a permission bypass, enabling physical escalation of privilege without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58978 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58978.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58978" }, { "cve": "CVE-2026-58979", "notes": [ { "category": "description", "text": "A logic error in the canPresent method of PresentationController.java may enable a permission bypass, resulting in local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58979 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58979.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58979" }, { "cve": "CVE-2026-58984", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability in multiple locations can lead to memory corruption, potentially enabling local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58984 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58984.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58984" }, { "cve": "CVE-2026-58985", "notes": [ { "category": "description", "text": "A logic error in the handleConnectInternal function of RpcServerTrusty.cpp can trigger a local denial of service without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58985 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58985.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58985" }, { "cve": "CVE-2026-58986", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing permission check in the notifyPictureProfileHandleSelection method of MediaQualityService.java can lead to local privilege escalation without requiring user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58986 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58986.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58986" }, { "cve": "CVE-2026-58988", "notes": [ { "category": "description", "text": "A missing bounds check in the isValid function of ShimConverter.cpp can cause an out-of-bounds read, potentially leading to local information disclosure without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58988 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58988.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58988" }, { "cve": "CVE-2026-58989", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing permission check in the setOemUnlockAllowedByUser method of OemLockService.java enables bypassing Factory Reset Protection (FRP) and allows local privilege escalation without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58989 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58989.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58989" }, { "cve": "CVE-2026-58990", "notes": [ { "category": "description", "text": "An integer overflow in l2c_fcr_process_peer_cfg_req of l2c_fcr.cc may lead to a memory safety issue enabling remote information disclosure without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58990 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58990.json" } ], "title": "CVE-2026-58990" }, { "cve": "CVE-2026-58994", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing permission check in multiple functions of NfcService.java can lead to local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58994 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58994.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58994" }, { "cve": "CVE-2026-58995", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "description", "text": "A heap buffer overflow in getEntryFileName of ZipFileRO.cpp can lead to memory safety issues, potentially enabling local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58995 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58995.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-58995" }, { "cve": "CVE-2026-58997", "notes": [ { "category": "description", "text": "A potential out-of-bounds read vulnerability in Bitmap.cpp's validateImageInfo function may lead to local information disclosure without requiring additional privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58997 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58997.json" } ], "title": "CVE-2026-58997" }, { "cve": "CVE-2026-59000", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A permission bypass vulnerability involving a confused deputy scenario enables local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59000 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59000.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59000" }, { "cve": "CVE-2026-59001", "notes": [ { "category": "description", "text": "A logic error in TelephonyProvider.java's checkQueryPermission method may allow permission bypass, leading to local information disclosure without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59001 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59001.json" } ], "title": "CVE-2026-59001" }, { "cve": "CVE-2026-59002", "notes": [ { "category": "description", "text": "A logic error in UsbDeviceManager.java's handleMessage function can lead to a lock-screen bypass, enabling physical information disclosure without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59002 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59002.json" } ], "title": "CVE-2026-59002" }, { "cve": "CVE-2026-59003", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing permission check in the getSubscriptionProperty method of SubscriptionManagerService.java can lead to local information disclosure without requiring user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59003 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59003.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59003" }, { "cve": "CVE-2026-59004", "cwe": { "id": "CWE-248", "name": "Uncaught Exception" }, "notes": [ { "category": "other", "text": "Uncaught Exception", "title": "CWE-248" }, { "category": "description", "text": "A permission bypass vulnerability due to an uncaught exception can enable local privilege escalation without needing additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59004 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59004.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59004" }, { "cve": "CVE-2026-59005", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing permission check in the insertInternal method of MmsProvider.java can lead to a multiuser isolation vulnerability, enabling local privilege escalation without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59005 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59005.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59005" }, { "cve": "CVE-2026-59006", "cwe": { "id": "CWE-451", "name": "User Interface (UI) Misrepresentation of Critical Information" }, "notes": [ { "category": "other", "text": "User Interface (UI) Misrepresentation of Critical Information", "title": "CWE-451" }, { "category": "description", "text": "A tapjacking vulnerability in the getTouchOcclusionMode method of WindowState.java allows local information disclosure via a tapjacking or overlay attack, requiring user interaction but no elevated execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59006 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59006.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59006" }, { "cve": "CVE-2026-59007", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "A logic error in the decode_packed_entry_number function of codebook.c can cause an out-of-bounds read, potentially leading to remote information disclosure without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59007 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59007.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59007" }, { "cve": "CVE-2026-59008", "notes": [ { "category": "description", "text": "A vulnerability in DevicePolicyManagerService.java's setApplicationRestrictions method can lead to local denial of service via resource exhaustion without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59008 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59008.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59008" }, { "cve": "CVE-2026-59010", "notes": [ { "category": "description", "text": "A missing bounds check in the deserialize function of legacy.rs can lead to a local denial of service without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59010 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59010.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59010" }, { "cve": "CVE-2026-59011", "notes": [ { "category": "description", "text": "A logic error in the code leads to a permission bypass across multiple locations, enabling local information disclosure without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59011 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59011.json" } ], "title": "CVE-2026-59011" }, { "cve": "CVE-2026-59012", "notes": [ { "category": "description", "text": "A missing permission check in the checkLastKnownCellIdAccessPermission method of TelephonyPermissions.java can lead to local information disclosure without user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59012 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59012.json" } ], "title": "CVE-2026-59012" }, { "cve": "CVE-2026-59014", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An integer overflow occurring in multiple locations can lead to out-of-bounds writes, potentially enabling local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59014 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59014.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59014" }, { "cve": "CVE-2026-59015", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A permission bypass vulnerability due to a confused deputy scenario can lead to local information disclosure without requiring additional privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59015 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59015.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59015" }, { "cve": "CVE-2026-59016", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory", "title": "CWE-22" }, { "category": "description", "text": "The sendAnomalyProfile method in ProfilingService.java contains a path traversal vulnerability enabling local privilege escalation without user interaction or additional execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59016 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59016.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59016" }, { "cve": "CVE-2026-59020", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization", "title": "CWE-362" }, { "category": "description", "text": "A race condition in the removeUserData method of DevicePolicyManagerService.java can lead to a local denial of service, requiring user execution privileges but no additional user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59020 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59020.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59020" }, { "cve": "CVE-2026-59021", "notes": [ { "category": "description", "text": "The document details a local denial of service vulnerability caused by improper input validation, exploitable without user interaction and requiring only user execution privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59021 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59021.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59021" }, { "cve": "CVE-2026-59022", "notes": [ { "category": "description", "text": "A logic error in multiple functions of MediaProvider.java may allow permission bypass, potentially leading to local information disclosure without user interaction or additional privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59022 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59022.json" } ], "title": "CVE-2026-59022" }, { "cve": "CVE-2026-59028", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary", "title": "CWE-441" }, { "category": "description", "text": "A permission bypass vulnerability in the resolveAidConflictLocked method of RegisteredAidCache.java enables local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59028 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59028.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59028" }, { "cve": "CVE-2026-59031", "notes": [ { "category": "description", "text": "A logic error in InputDispatcher::flushSensor within InputDispatcher.cpp can trigger a local denial of service without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59031 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59031.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59031" }, { "cve": "CVE-2026-59042", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization", "title": "CWE-362" }, { "category": "description", "text": "A race condition in the __pkvm_pages_to_ppages function of mmu.c can cause an out-of-bounds write, potentially enabling local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59042 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59042.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59042" }, { "cve": "CVE-2026-59043", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization", "title": "CWE-362" }, { "category": "description", "text": "A race condition in the arm_lpae_split_blk_unmap function of io-pgtable-arm-common.c can lead to memory corruption, enabling local privilege escalation without additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59043 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59043.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59043" }, { "cve": "CVE-2026-59044", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A logic error in multiple locations causes use-after-free vulnerabilities that can lead to local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59044 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59044.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59044" }, { "cve": "CVE-2026-59045", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization", "title": "CWE-362" }, { "category": "description", "text": "A race condition vulnerability can lead to memory corruption, enabling local privilege escalation without requiring additional execution privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59045 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59045.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59045" }, { "cve": "CVE-2026-59046", "notes": [ { "category": "description", "text": "An out-of-bounds write vulnerability in the __pkvm_guest_relinquish_to_host function of mem_protect.c can lead to a local denial of service without requiring user interaction or elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59046 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59046.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59046" }, { "cve": "CVE-2026-59047", "notes": [ { "category": "description", "text": "A logic error in the code can trigger a local denial of service without requiring user interaction or elevated execution privileges, potentially impacting system availability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59047 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59047.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-59047" }, { "cve": "CVE-2026-59048", "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability in the rb_cpu_init function of trace.c may cause local information disclosure without requiring additional privileges or user interaction.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-59048 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59048.json" } ], "title": "CVE-2026-59048" }, { "cve": "CVE-2026-64011", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities affecting Linux kernel subsystems, including Arm and AMD Zen 2 processors, device drivers, and NFC, were addressed to fix privilege escalation, memory corruption, and denial of service issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64011 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64011.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64011" }, { "cve": "CVE-2026-64427", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "A vulnerability in the Linux kernel's HID Logitech DJ driver allows a crafted zero-field report to cause a null pointer dereference during device probe, leading to a denial of service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64427 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64427.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64427" }, { "cve": "CVE-2026-64560", "cwe": { "id": "CWE-364", "name": "Signal Handler Race Condition" }, "notes": [ { "category": "other", "text": "Signal Handler Race Condition", "title": "CWE-364" }, { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization", "title": "CWE-362" }, { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel, including a use-after-free race condition in posix-cpu-timers during non-leader exec() and flaws in AMD processors and various subsystems, were addressed with detailed CVEs.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64560 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64560.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64560" }, { "cve": "CVE-2026-65076", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65076 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65076.json" } ], "title": "CVE-2026-65076" }, { "cve": "CVE-2026-65586", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Non-privileged software can exploit improper GPU system calls to manipulate memory buffers still in use, enabling arbitrary physical memory reads or writes by granting the GPU access to memory outside CPU driver control.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65586 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65586.json" } ], "title": "CVE-2026-65586" }, { "cve": "CVE-2026-65587", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A web page containing unusual WebGPU content can trigger an out-of-bounds write in the GPU user-space driver, resulting in memory corruption, crashes, and undefined behavior.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65587 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65587.json" } ], "title": "CVE-2026-65587" }, { "cve": "CVE-2026-66086", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "A stack-based buffer overflow in the modem OTA stack from improper validation of scheduling info in SIB1 messages can enable remote code execution or denial of service without extra privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-66086 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-66086.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-66086" }, { "cve": "CVE-2026-66113", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-66113 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-66113.json" } ], "title": "CVE-2026-66113" }, { "cve": "CVE-2026-66114", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-66114 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-66114.json" } ], "title": "CVE-2026-66114" }, { "cve": "CVE-2026-74912", "cwe": { "id": "CWE-823", "name": "Use of Out-of-range Pointer Offset" }, "notes": [ { "category": "other", "text": "Use of Out-of-range Pointer Offset", "title": "CWE-823" }, { "category": "description", "text": "The security fix for CVE-2026-49746 on GPU systems restricts graphics buffer mapping ranges, causing integer truncation errors and limiting kernel mode driver functionality within the 0GB-4GB buffer page range.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-74912 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-74912.json" } ], "title": "CVE-2026-74912" }, { "cve": "CVE-2026-79405", "notes": [ { "category": "description", "text": "A transient denial of service (DoS) vulnerability arises from improper input validation when processing malformed NR RRC configuration messages, potentially disrupting normal network operations.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-79405 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-79405.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-79405" }, { "cve": "CVE-2026-80013", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-80013 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-80013.json" } ], "title": "CVE-2026-80013" }, { "cve": "CVE-2026-80335", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A memory corruption vulnerability exists during firmware update data processing in Download mode due to a missing bounds check, potentially affecting device stability and security.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-80335 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-80335.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 7.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-80335" }, { "cve": "CVE-2026-80336", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-80336 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-80336.json" } ], "title": "CVE-2026-80336" }, { "cve": "CVE-2026-80604", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "A Linux kernel security update fixes multiple vulnerabilities including a critical AMD SEV-SNP memory integrity flaw (CVE-2023-20585) and an out-of-bounds read in the HID core caused by improper size validation of numbered reports.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-80604 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-80604.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-80604" }, { "cve": "CVE-2026-89774", "notes": [ { "category": "description", "text": "Multiple critical vulnerabilities in AMD processors and the Linux kernel, including improper Reverse Map Table checks, null pointer dereference, privilege escalation, and use-after-free in Bluetooth SCO handling, have been addressed with extensive security fixes.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-89774 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-89774.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-89774" } ] }