medium · CVSS v3 5.5

CVE-2026-20550

CVE-2026-20550 is an out‑of‑bounds write in GNSS firmware that can cause a local denial of service. The flaw requires user interaction and d

Overview

CVE-2026-20550 is an out‑of‑bounds write in GNSS firmware that can cause a local denial of service. The flaw requires user interaction and does not grant elevated privileges. It affects GNSS receivers and related software components.

Description

In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11309816; Issue ID: MSV-10731.

Impact

The vulnerability can lead to a denial of service, disrupting the confidentiality of operational data by preventing normal GNSS operation. Availability is directly impacted for devices that rely on GNSS for positioning. The threat is limited to local users who can trigger the fault via user interaction.

Remediation

Apply the vendor’s patch ALPS11309816 to the GNSS firmware or software stack. Verify the patch deployment with checksum or version check. As a temporary mitigation, disable or restrict GNSS services until the patch is applied.

Risk context

The CVSS v3 score of 5.5 indicates a medium severity. With no EPSS data, the risk remains moderate but should be addressed promptly to prevent local service disruption.

Affected products

  • GNSS Receiver Firmware
  • GNSS Module
  • GNSS Software Stack
  • GNSS Driver

Scores

Severity
medium
CVSS v2
2.1
CVSS v3
5.5
CVSS v4
—
EPSS
—

denial-of-service out-of-bounds GNSS local patch medium user-interaction

← All CVEs

Related CVEs

medium

CVE-2026-20551

CVE-2026-20551 is a medium‑severity vulnerability in GNSS firmware that allows an out‑of‑bounds write due to a missing bounds check. The flaw can cause a local denial‑of‑service (DoS) without privilege escalation, but requires user interaction to trigger. It is relevant to devices that rely on GNSS for positioning, such as smartphones, automotive systems, and IoT devices.

View analysis

medium

CVE-2026-20553

CVE-2026-20553 is an out‑of‑bounds write flaw in DA firmware that can be exploited locally without user interaction. The vulnerability allows an attacker with physical access to elevate privileges on the device. It is rated medium severity with a CVSS v3 score of 6.8.

View analysis

medium

CVE-2026-20564

In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01780439; Issue ID: MSV-8901.

View analysis

medium

CVE-2026-20577

In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01880753; Issue ID: MSV-9866.

View analysis