DEBIAN-CVE-2026-56438: Medium severity debian/libva vulnerability
Uncontrolled search path for the libva software for all versions within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libvato a version that resolves this vulnerability.Fixed in 2.24.0-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
The issue affects Debian systems using libva where an authenticated, unprivileged local user can satisfy the attack requirements. It is a local privilege-escalation scenario rather than a remote attack.
What does an attacker need to exploit it?
An attacker needs local access as an authenticated user, a high-complexity attack path, and active user interaction. The available data does not indicate that special internal knowledge is required.
What could successful exploitation allow?
Successful exploitation may allow escalation of privilege and could have high impact on the vulnerable system's confidentiality, integrity, and availability. No subsequent-system impact is identified.