{"id":"CVE-2026-56438","kind":"vulnerability","aliases":["CVE-2026-56438"],"related":[],"title":"libva: uncontrolled search path lets a local user escalate privilege","description":"Uncontrolled search path for the libva software for all versions within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"libva, the Video Acceleration API library used on Linux for hardware video decoding, loads a library through an uncontrolled search path. A local user with an account can exploit this to escalate privileges, with a high-complexity attack that needs active user interaction.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","libva","linux","local-users"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T17:17:44+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","triaged_at":"2026-11-10T17:24:23+00:00","updated_at":"2026-11-10T17:24:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T17:24:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"libva: uncontrolled search path lets a local user escalate privilege","impact":"high","summary":"libva, the Video Acceleration API library used on Linux for hardware video decoding, loads a library through an uncontrolled search path. A local user with an account can exploit this to escalate privileges, with a high-complexity attack that needs active user interaction.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["libva","linux","local-users"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the machine","analyst_note":"Find the affected libva version range and fixed release from the NVD entry or the upstream libva advisory; the description gives no versions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Only machines with libva installed and a local, authenticated user are in scope, since the attack starts from local access. The sources do not list affected versions or a fixed release, so the team should confirm the installed libva version against the vendor advisory. Systems without libva, or with no untrusted local users, are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4639,"output_tokens":464,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-56438':13A,16A '3':79C 'acceler':26B 'access':113C 'account':49B 'activ':64B,125C 'adversari':90C 'allow':83C 'api':27B 'applic':81C 'attack':61B,100C,115C 'authent':93C 'avail':139C,154C 'combin':95C 'complex':60B,99C 'confidenti':134C,149C 'cve':11A,14A 'decod':35B 'enabl':102C 'escal':9A,54B,85C,103C 'exploit':51B 'hardwar':33B 'high':59B,98C,135C,137C,140C 'high-complex':58B 'impact':132C,156C 'infrastructur':17B 'integr':136C,151C 'interact':66B,127C 'intern':121C 'knowledg':122C 'let':5A 'librari':28B,38B 'libva':1A,18B,23B,72C 'linux':19B,31B 'load':36B 'local':7A,21B,45B,112C 'local-us':20B 'may':82C,101C,108C,131C 'need':63B 'none':150C,152C,155C 'occur':110C 'path':4A,43B,69C 'potenti':109C,129C 'present':118C 'privileg':10A,55B,87C,105C 'requir':116C,124C 'result':107C,145C 'ring':78C 'search':3A,42B,68C 'softwar':73C,89C 'special':120C 'subsequ':147C 'system':144C,148C 'uncontrol':2A,41B,67C 'unprivileg':88C 'use':29B 'user':8A,22B,46B,65B,80C,94C,126C 'version':76C 'via':111C 'video':25B,34B 'vulner':130C,143C 'within':77C 'without':119C","nicknames":[],"mitigations":[],"who_affected":"Only machines with libva installed and a local, authenticated user are in scope, since the attack starts from local access. The sources do not list affected versions or a fixed release, so the team should confirm the installed libva version against the vendor advisory. Systems without libva, or with no untrusted local users, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","libva","linux","localusers","medium"],"campaign_type":null,"search_a":"'-2026':12A,15A '-56438':13A,16A 'cve':11A,14A 'escal':9A 'let':5A 'libva':1A 'local':7A 'path':4A 'privileg':10A 'search':3A 'uncontrol':2A 'user':8A","search_b":"'acceler':26B 'account':49B 'activ':64B 'api':27B 'attack':61B 'complex':60B 'decod':35B 'escal':54B 'exploit':51B 'hardwar':33B 'high':59B 'high-complex':58B 'infrastructur':17B 'interact':66B 'librari':28B,38B 'libva':18B,23B 'linux':19B,31B 'load':36B 'local':21B,45B 'local-us':20B 'need':63B 'path':43B 'privileg':55B 'search':42B 'uncontrol':41B 'use':29B 'user':22B,46B,65B 'video':25B,34B","search_c":"'3':79C 'access':113C 'activ':125C 'adversari':90C 'allow':83C 'applic':81C 'attack':100C,115C 'authent':93C 'avail':139C,154C 'combin':95C 'complex':99C 'confidenti':134C,149C 'enabl':102C 'escal':85C,103C 'high':98C,135C,137C,140C 'impact':132C,156C 'integr':136C,151C 'interact':127C 'intern':121C 'knowledg':122C 'libva':72C 'local':112C 'may':82C,101C,108C,131C 'none':150C,152C,155C 'occur':110C 'path':69C 'potenti':109C,129C 'present':118C 'privileg':87C,105C 'requir':116C,124C 'result':107C,145C 'ring':78C 'search':68C 'softwar':73C,89C 'special':120C 'subsequ':147C 'system':144C,148C 'uncontrol':67C 'unprivileg':88C 'user':80C,94C,126C 'version':76C 'via':111C 'vulner':130C,143C 'within':77C 'without':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56438","severity":null,"published_at":"2026-11-10T17:17:44+00:00","modified_at":"2026-11-10T17:17:44+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","fetched_at":"2026-11-10T17:22:44+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}