CVE-2026-20485: Medium severity HFRP vulnerability
In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11049569; Issue ID: MSV-7931.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HFRPto a version that resolves this vulnerability.Patch ALPS11049569 - Compensating control
Because exploitation can lead to local escalation of privilege when an attacker already has System privilege and requires no user interaction, restrict/monitor local execution and privilege-access paths so only trusted processes/users can run HFRP (e.g., tighten local access controls/least privilege to reduce the chance of obtaining System privilege).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20485?
CVE-2026-20485 has a risk rating of 41, indicating a significant potential for impact.
How do I fix CVE-2026-20485?
To fix CVE-2026-20485, apply the patch identified as ALPS11049569.
What type of vulnerability is CVE-2026-20485?
CVE-2026-20485 is an out of bounds write vulnerability that can lead to local escalation of privilege.
Who is at risk from CVE-2026-20485?
CVE-2026-20485 primarily affects users who have already obtained System privilege on their devices.
Is user interaction required to exploit CVE-2026-20485?
No, user interaction is not needed for the exploitation of CVE-2026-20485.