CVE-2026-20971

Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code

High · published January 9, 2026

CVSS v4.0
7.3
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

⚡ Local attackers might just have a door wide open! A Use After Free vulnerability in the PROCA driver before the SMR Jan-2026 Release 1 could allow execution of arbitrary code. 🔥 Think of it like a restaurant that still serves a dish after someone has already returned it, thinking it’s safe. The chef, however, hasn't checked the order list—leading to potential disaster if someone orders it again! If exploited, this vulnerability could lead to arbitrary code execution, allowing an attacker to run potentially malicious code on the system. Imagine a local intruder taking control and changing orders in the kitchen, messing up operations and endangering your patrons.

Put simply

Think of it like a restaurant that still serves a dish after someone has already returned it, thinking it’s safe. The chef, however, hasn't checked the order list—leading to potential disaster if someone orders it again! This vulnerability arises from a Use After Free condition in the PROCA driver, where memory that has already been freed is still accessible. This oversight can let attackers manipulate code execution, leading to unauthorized actions on the system.

What to do

If exploited, this vulnerability could lead to arbitrary code execution, allowing an attacker to run potentially malicious code on the system. Imagine a local intruder taking control and changing orders in the kitchen, messing up operations and endangering your patrons. To protect against this, ensure you update to the latest version of the PROCA driver, specifically after the SMR Jan-2026 Release 1. Additionally, conduct a thorough review of your environment for any unusual behavior and implement local access controls. You've got this! Stay proactive and secure your systems to keep those kitchen disasters at bay! 🛡️

The record
Technical detail
CVSS v4.0
7.3 · HIGH
Vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00169 · 6.0th percentile
Published
2026-01-09T06:16Z
EPSS history
Timeline
  • 09 JAN 06:16Z
    Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code
    cvelistv5