What’s Vulnerable › Vulnerabilities
CVE-2026-20435
- Severity: medium (CVSS 4.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-02 · updated 2026-06-17
- Weakness: CWE-522
Description
In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.
Affected products
- Android: 14.0, 15.0, 16.0
- Linuxfoundation Yocto: 4.0
- openwrt: 21.02.0, 23.05.0
- Rdkcentral Rdk-B: 2022q3, 2024q1
- zephyrproject zephyr: 3.7.0
References
Get alerted when CVE-2026-20435 or the next vulnerability affects your stack