Quartus Prime Pro CVE-2025-13663

Exploitation requires that the target Quartus installation directory ALREADY EXISTS at install time - only then does the installer fail to validate/correct that directory's permissions (CWE-279). A local low-privileged attacker must be able to create or control that directory (and its ACLs) beforehand, and a user/administrator must subsequently run the Quartus Prime Pro installer (UI:A - active interaction) targeting it. Limiting factors that reduce real-world risk: the attack is local only (AV:L), has high complexity with a specific required condition (AC:H/AT:P), is Windows-specific, and depends on the non-default situation of installing over a pre-staged directory rather than a clean install path.

This is a genuinely low-to-moderate priority local issue, not a high-urgency network threat. The provided CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:A) describes a locally-exploitable flaw with high attack complexity, a required attack condition (AT:P - the target install directory must already exist), low privileges needed, and active user interaction (an operator must run the installer). The 5.4 (Medium) score aligns with the high VC/VI/VA impact being gated behind substantial preconditions. All exploitation signals point to low real-world risk: EPSS is 0.10% (1st percentile - negligible predicted exploitation), there is no CISA KEV listing (no confirmed active exploitation), and no public exploit code was identified in the provided data. No SSVC decision data was supplied. The one caveat is impact: because the installer assigns no permission correction to a pre-existing directory (CWE-279), a successful attack can yield high confidentiality, integrity, and availability impact locally, including potential privilege escalation. Net: a real but low-likelihood local privilege/tampering weakness, not an internet-facing emergency.

A low-privileged local user pre-creates the Quartus Prime Pro installation directory with weak, attacker-writable ACLs. When an administrator later installs Quartus into that existing directory, the installer skips the permission check and leaves the attacker with write access to privileged files, enabling later binary tampering or privilege escalation. No public exploit was identified at time of analysis.