CVE-2026-21419

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21419", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2025-12-24T16:33:47.094Z", "datePublished": "2026-02-09T17:01:19.910Z", "dateUpdated": "2026-02-26T15:04:14.452Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Display and Peripheral Manager (Windows)", "vendor": "Dell", "versions": [{"lessThan": "2.2.0.18", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "CVE-2026-21419: Dell Technologies would like to thank falconCorrup for reporting this issue."}], "datePublic": "2026-02-06T18:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability in the Installer and Service. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges"}], "value": "Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability in the Installer and Service. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-02-09T17:01:19.910Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000384542/dsa-2026-009"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21419", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-10T04:55:25.268226Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:14.452Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21419", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-10T04:55:25.268226Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T18:51:45.558Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "CVE-2026-21419: Dell Technologies would like to thank falconCorrup for reporting this issue."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "Display and Peripheral Manager (Windows)", "versions": [{"status": "affected", "version": "N/A", "lessThan": "2.2.0.18", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-06T18:00:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000384542/dsa-2026-009", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability in the Installer and Service. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges", "supportingMedia": [{"type": "text/html", "value": "Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability in the Installer and Service. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-02-09T17:01:19.910Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21419", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:04:14.452Z", "dateReserved": "2025-12-24T16:33:47.094Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-02-09T17:01:19.910Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Display and Peripheral Manager (Windows)", "vendor": "Dell", "versions": [{"lessThan": "2.2.0.18", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability in the Installer and Service. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges"}, {"lang": "es", "value": "Versiones de Dell Display and Peripheral Manager (Windows) anteriores a la 2.2 contienen una vulnerabilidad de 'Resoluci\u00f3n de Enlace Incorrecta Antes del Acceso a Archivos' ('Seguimiento de Enlaces') en el Instalador y el Servicio. Un atacante con pocos privilegios y acceso local podr\u00eda potencialmente explotar esta vulnerabilidad, lo que llevar\u00eda a una Elevaci\u00f3n de Privilegios."}], "id": "CVE-2026-21419", "lastModified": "2026-06-17T10:18:38.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.2, "source": "security_alert@emc.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21419", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T04:55:25.268226Z", "version": "2.0.3"}}]}, "published": "2026-02-09T18:16:05.893", "references": [{"source": "security_alert@emc.com", "url": "https://www.dell.com/support/kbdoc/en-us/000384542/dsa-2026-009"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.2.0.18)"}}], "product": "display_and_peripheral_manager", "vendor": "dell"}], "analysis": {"en": {"generated_at": "2026-04-17T21:25:05.404435+00:00", "value": {"mitigation_remediation": ["Apply the latest Dell Display and Peripheral Manager update (version 2.2 or later) to remove the link resolution flaw.", "Restrict local accounts from executing the installer or service and enforce least privilege for system services to prevent unauthorized code execution.", "Ensure installation sources are signed and trusted by Dell, and disable automatic execution of peripheral drivers when not required."], "summary": {"action": "Apply Patch", "impact": "Elevation of Privileges"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Dell Display and Peripheral Manager (Windows) versions prior to 2.2. Users running these versions are at risk if the installer or service processes untrusted input. The issue applies to the Windows installation of the product.", "description_and_impact": "Dell Display and Peripheral Manager for Windows is vulnerable to improper link resolution before file access, known as Link Following (CWE-59). A local attacker with low privileges could maliciously manipulate the installer or service to follow a crafted link, resulting in the ability to execute arbitrary code with elevated system privileges.", "risk_and_exploitability": "The CVSS base score of 6.6 classifies the flaw as moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. Local access is required, and the attacker must have at least low system privileges to mount the attack, making remote exploitation unlikely. The vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, further suggesting limited real-world exploitation."}}}}, "created": "2026-02-10T15:37:35.811604+00:00", "title": "Elevation of Privileges via Improper Link Resolution in Dell Display and Peripheral Manager Installer", "updated": "2026-04-17T21:30:28.389614+00:00", "vendors": ["dell", "dell$PRODUCT$display_and_peripheral_manager"]}