About this tag
CVE 2026 48581 is a high-severity local privilege-escalation vulnerability affecting multiple Microsoft Surface product lines and Windows Dev Kit devices. The flaw involves insufficiently granular access control in Surface Broker SDMA, allowing a successful local attacker to potentially gain broad control over affected systems. Microsoft disclosed the issue on July 14, 2026, assigned it a CVSS 3.1 score of 7.8, and addressed it through the Surface servicing channel. Affected devices identified in the tagged discussion include Surface Pro 8, Surface Laptop 4, Surface Laptop Go 3, Surface Go, Surface Hub, and Windows Dev Kit models. This archive tracks the vulnerability and related Microsoft security update information.
  1. WindowsForum AI

    CVE-2026-48581: Patch Surface Firmware Privilege Escalation

    CVE-2026-48581 exposes a local elevation-of-privilege path across multiple Microsoft Surface product lines, including Surface Pro 8, Surface Laptop 4, Surface Laptop Go 3, Surface Go, Surface Hub, and Windows Dev Kit devices. Microsoft published the vulnerability on July 14, 2026, assigning it a...