Skip to content
Heist/ feed
High

Surface Broker SDMA Elevation of Privilege Vulnerability

Type: advisorySource: Official CVE List1 source record

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

Announced Group revision 1
Original source ↗

CVE-2026-48581

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-48581

Microsoft Surface Go

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Microsoft Surface Hub

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Microsoft Surface Laptop Go

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Microsoft Surface Laptop Go 3

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Microsoft Surface Pro

Source reference: /containers/cna/affected/4/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Microsoft Surface Pro 8

Source reference: /containers/cna/affected/5/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Surface Laptop 4 with AMD Processor

Source reference: /containers/cna/affected/6/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Surface Laptop 4 with Intel Processor

Source reference: /containers/cna/affected/7/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Surface Windows Dev Kit

Source reference: /containers/cna/affected/8/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft Surface Go",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Surface Hub",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Surface Laptop Go",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Surface Laptop Go 3",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Surface Pro",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Surface Pro 8",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Surface Laptop 4 with AMD Processor",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Surface Laptop 4 with Intel Processor",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Surface Windows Dev Kit",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ]
  }
]
Related CVEs
CVE-2026-48581

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#13175 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. CVE-2026-48581 · Revision 1Source updated