Vulnerability · NVD

CVE-2026-46232

CVE-2026-46232 : high severity (CVSS 8.1). No tracked catalog app is linked to this CVE.

Severity (CVSS): 8.1
Exploitation: 0.3 %
Tracked apps: 0
Still exposed: 0

Published on 2026-05-28

In the Linux kernel, the following vulnerability has been resolved:

HID: playstation: Clamp num_touch_reports

A device would never lie about the number of touch reports would it?

If it does the loop in dualshock4_parse_report will read off the end of
the touch_reports array, up to about 2 KiB for the maximum number of 256
loop iteraions. The data that is read is emitted via evdev if the
DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by
clamping the num_touch_reports value provided by the device to the
maximum size of the touch_reports array.

Attack vector : Adjacent network No privileges required No user interaction

Show raw CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS 0.26% exploit very unlikely percentile 17.5%

OS versions that fix this CVE

This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.

Android Fixed in November 2026 patch level

View on NVD ↗ Advisory · git.kernel.org

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM