Windows imgsys OOB Write LPE (System)
CVE-2026-20413 Published on February 2, 2026
In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10362725; Issue ID: MSV-5694.
Vulnerability Analysis
CVE-2026-20413 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Improper Validation of Specified Index, Position, or Offset in Input
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Products Associated with CVE-2026-20413
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-20413 are published in Microsoft Windows:
Affected Versions
MediaTek, Inc. MT6899, MT6991, MT8678, MT8793 Version Android 15.0 is affected by CVE-2026-20413Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.