CVE-2026-48581
Surface Broker SDMA Elevation of Privilege Vulnerability
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Surface Broker SDMA Elevation of Privilege Vulnerability
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
- Record
CVE-2026-48581- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-1220
- Updated
- 2026-11-02
EUVDEUVD-2026-43794
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
- Record
EUVD-2026-43794- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-59xf-77x2-pv8f
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to...
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
- Record
GHSA-59xf-77x2-pv8f- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1220
- Updated
- 2026-11-02
NVD
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
- Record
CVE-2026-48581- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1220
- Updated
- 2026-11-02
Affected products
- microsoft surface go
- microsoft surface hub
- microsoft surface laptop go
- microsoft surface laptop go 3
- microsoft surface pro
- microsoft surface pro 8
- microsoft surface laptop 4 with amd processor
- microsoft surface laptop 4 with intel processor
- microsoft surface windows dev kit
- microsoft surface go 2 1901 firmware
- microsoft surface go 2 1926 firmware
- microsoft surface go 2 1927 firmware
Show 24 moreShow less
- microsoft surface go 3 1901 firmware
- microsoft surface go 3 1926 firmware
- microsoft surface go 3 2022 firmware
- microsoft surface hub 2s 85 firmware
- microsoft surface hub 2s firmware
- microsoft surface hub 3 50 firmware
- microsoft surface hub 3 85 firmware
- microsoft surface hub firmware
- microsoft surface laptop 4 1950 firmware
- microsoft surface laptop 4 1951 firmware
- microsoft surface laptop 4 1952 firmware
- microsoft surface laptop 4 1953 firmware
- microsoft surface laptop 4 1958 firmware
- microsoft surface laptop 4 1959 firmware
- microsoft surface laptop 4 1978 firmware
- microsoft surface laptop 4 1979 firmware
- microsoft surface laptop go 1943 firmware
- microsoft surface laptop go 2 2013 firmware
- microsoft surface laptop go 3 2013 firmware
- microsoft surface pro 7\+ 1960 firmware
- microsoft surface pro 7\+ with lte advanced 1961 firmware
- microsoft surface pro 8 1983 firmware
- microsoft surface pro 8 for business 1983 firmware
- microsoft surface pro 8 for business with lte advanced 1982 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-48581 is a high vulnerability (CVSS 7.8) in Microsoft Surface Go, published July 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. No source names a fixed version.