CVE-2026-20446

CVE-2026-20446 is an integer overflow vulnerability in secure boot functionality that enables out-of-bounds write operations. The flaw affects systems running affected ALPS code versions and requires an attacker to have physical access to the device along with local user-level privileges. Exploitation does not require user interaction, making it a concern for physical attack scenarios. The vulnerability carries a CVSS severity rating of 4.3 (Medium) with a physical attack vector and low complexity. While confidentiality and integrity are not impacted, the flaw can result in high-impact denial of service conditions. The EPSS score of 0.00006 indicates this is an uncommon threat profile relative to the broader CVE population. There is currently no evidence of active exploitation, as this CVE is not listed in the Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. The patch is available under ID ALPS09963054. Community attention appears minimal given the combination of requiring physical access, local privileges, and low prevalence metrics, though organizations managing devices in high-security or physically accessible environments should prioritize patch deployment.