CVE-2025-41726

—

CVSS 3.1

8.8 high

EPSS

<1%p36

Published

Jan 27, 2026 (Jan 27, 2026)

Modified

Jun 17, 2026

Description

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.

Weakness: CWE-190
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.