CVE-2026-0107
High · 8.4CVSS
8.4
EPSS
0.1%
Published
Mar 10, 2026
CISA due date
—
The record
In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
- CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
- CVE-2026-86003 CoreDNS is a DNS server written in Go. CWE-441
- CVE-2026-87582 Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
- CVE-2026-87502 Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
- CVE-2026-87453 Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a… CWE-441
- CVE-2026-87442 Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
- CVE-2026-86600 In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud… CWE-441