Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-56438 EUVD-2026-121324GHSA-3qf6-f6mq-xr2c

Uncontrolled search path for the libva software for all versions within Ring 3: User Applications may allow an escalation of privilege. Unp…

Published Nov 10, 2026 · Updated Nov 11, 2026 · Assigned by intel

Description

Uncontrolled search path for the libva software for all versions within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Affected products

VendorProductAffectedFixed
— libva software all versions —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libva 2.24.0-1 —
Debian 13 libva No fix yet —
Debian 12 libva No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS libva No fix yet —
Ubuntu 24.04 LTS libva No fix yet —
Ubuntu 22.04 LTS libva No fix yet —
Ubuntu 20.04 LTS libva No fix yet —
Ubuntu 18.04 LTS libva No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS libva No fix yet —
Ubuntu 14.04 LTS libva No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libva No fix yet —

Advisories 1

References