CVE-2026-20407CWE-787

In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check

Critical · published February 2, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

🔥 A missing bounds check in the wlan STA driver means a local user could escalate their privileges without any special tricks — like an authorized guest getting keys to every room! ⚡ Think of it like a hotel with a front desk that forgets to verify the guest's ID. One guest could end up accessing the penthouse suite without any checks, potentially wreaking havoc! This oversight could allow a local attacker to elevate their privileges to an admin level, opening the door to unauthorized access and control over critical system functions. The consequences could be absolutely devastating, providing attackers with the power to manipulate system configurations or data!

Put simply

Think of it like a hotel with a front desk that forgets to verify the guest's ID. One guest could end up accessing the penthouse suite without any checks, potentially wreaking havoc! The vulnerability in the wlan STA driver lacks a proper bounds check, enabling a local user to execute malicious actions with escalated privileges without needing any user interaction. This means that once they have local access, they could exploit this weakness seamlessly.

What to do

This oversight could allow a local attacker to elevate their privileges to an admin level, opening the door to unauthorized access and control over critical system functions. The consequences could be absolutely devastating, providing attackers with the power to manipulate system configurations or data! To protect yourself, patch the wlan STA driver with ID WCNCR00464377 as soon as possible. Ensure all systems are updated, and review local access permissions to mitigate potential exploitation. Don't wait until it's too late! You've got this! Follow these steps and you'll bolster your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-02-02T08:14Z
EPSS history
Timeline
  • 02 FEB 08:14Z
    In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check
    cvelistv5