CVE-2025-41726

8.8 highEPSS 0.5%

High (8.8). EPSS 0.5% chance of exploitation in the next 30 days.

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-190
Published: 2026-01-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://certvde.com/de/advisories/VDE-2025-092

Check your stack JSON