high7.8
CVE-2026-48581
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
Impact
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Surface Go 2 1901 Firmware | All versions |
| Microsoft | Surface Go 2 1926 Firmware | All versions |
| Microsoft | Surface Go 2 1927 Firmware | All versions |
| Microsoft | Surface Go 3 1901 Firmware | All versions |
| Microsoft | Surface Go 3 1926 Firmware | All versions |
| Microsoft | Surface Go 3 2022 Firmware | All versions |
| Microsoft | Surface Hub Firmware | All versions |
| Microsoft | Surface Hub 2s Firmware | All versions |
| Microsoft | Surface Hub 2s 85 Firmware | All versions |
| Microsoft | Surface Hub 3 50 Firmware | All versions |
| Microsoft | Surface Hub 3 85 Firmware | All versions |
| Microsoft | Surface Laptop Go 1943 Firmware | All versions |
| Microsoft | Microsoft Surface Go | All versions Version - |
| Microsoft | Microsoft Surface Hub | All versions Version - |
| Microsoft | Microsoft Surface Laptop Go | All versions Version - |
| Microsoft | Microsoft Surface Laptop Go 3 | All versions Version - |
| Microsoft | Microsoft Surface Pro | All versions Version - |
| Microsoft | Microsoft Surface Pro 8 | All versions Version - |
| Microsoft | Surface Laptop 4 With AMD Processor | All versions Version - |
| Microsoft | Surface Laptop 4 With Intel Processor | All versions Version - |
| Microsoft | Surface Windows Dev Kit | All versions Version - |