CVE-2026-20586
High · 8.8CVSS
8.8
EPSS
—
Published
Oct 5, 2026
CISA due date
—
The record
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9614.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-78402 Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys… CWE-787
- CVE-2026-119777 A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. CWE-787
- CVE-2026-104065 Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw… CWE-787
- CVE-2026-104067 Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the… CWE-787
- CVE-2026-104066 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image… CWE-787
- CVE-2026-104061 Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the… CWE-787
- CVE-2026-104062 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image… CWE-787
- CVE-2026-61627 libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation… CWE-787