CVE-2026-20502: Security vulnerability
Published Sep 7, 2026
·Updated
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11262030; Issue ID: MSV-9196.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS11262030
Event History
Sep 7, 2026
CVE Published
via MITRE·01:57 AM
Data Sourced
via MITRE·01:57 AM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
Exploitation is local and can lead to escalation of privilege. No additional execution privileges are needed, and user interaction is not required.
2
What component is affected and what is the underlying flaw?
The issue affects vdec. It is an out-of-bounds write caused by a missing bounds check.
3
What patch or tracking identifiers should teams use when coordinating remediation?
Use Patch ID ALPS11262030 and Issue ID MSV-9196 to identify the fix and track remediation.