CVE-2026-48581 is a Surface Broker SDMA elevation of privilege vulnerability caused by insufficient granularity of access control. It has a CVSS v3.1 base score of 7.8 and temporal score of 6.8, with a LOCAL attack vector, LOW attack complexity, LOW privileges required, and no user interaction. Microsoft says exploitation is not publicly disclosed, not exploited, and exploit code maturity is UNPROVEN. If successfully exploited, an attacker could gain SYSTEM privileges. This is a high-severity local privilege escalation issue, which is more relevant to systems where an attacker can already execute code or obtain local access than to network-exposed services.

Highlights:
- CVSS scores: Base 7.8 - Temporal 6.8
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Elevation of Privilege; confidentiality, integrity, and availability impacts are HIGH.
- Exploitation likelihood: Exploitation Less Likely; LOCAL vector, LOW attack complexity, LOW privileges required, and NO user interaction.
- Severity for enterprise: High technical severity, but enterprise risk is mainly on local endpoints or devices where an attacker can obtain local execution or access; it is not a remote attack surface issue.
- Patch status: available; customer action required.

Affected systems:
- Surface devices