Quartus Prime CVE-2025-13664

Exploitation requires an uncontrolled search path element (CWE-427): the attacker must already have low-privileged local access (PR:L) to a system where Quartus Prime Standard Edition is installed, must be able to write a malicious library/binary into a location the software searches, and must wait for a higher-privileged user to launch or operate the software (UI:A, active user interaction). Limiting factors are significant: the attack is local-only (AV:L, not remotely reachable), has high complexity (AC:H), carries a present attack requirement (AT:P) meaning specific non-default conditions must hold, and cannot succeed without the privileged victim actually running the vulnerable software. These constraints sharply narrow realistic exploitation to staged, targeted local scenarios rather than remote or automated attacks.

This is a genuinely low-to-moderate real-world risk despite the CWE-427 privilege-escalation classification. The input CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:A) describes a local attack that is hard to pull off: the attacker already needs low-level local privileges (PR:L), success depends on a present attack requirement (AT:P) and high complexity (AC:H), and a victim must actively interact (UI:A) - i.e., a higher-privileged user has to run the affected software under conditions the attacker has staged. All signals are consistent and point AWAY from urgency: EPSS is 0.11% (1st percentile), the CVE is NOT on CISA KEV, and no public exploit is referenced. There is no SSVC decision data in the input. The only tension is that impact is rated High across confidentiality, integrity, and availability (VC:H/VI:H/VA:H), which inflates the base score to 5.4, but the exploitability barriers (local access, prior privileges, user interaction, high complexity) make opportunistic or widespread exploitation implausible. Net: a credible local privilege-escalation issue worth patching on developer workstations, not a drop-everything emergency. Note: CWE-427 (uncontrolled search path) is inferred as the mechanism; the terse vendor description ('may allow escalation of privilege') does not spell out the exact trigger - verify specifics with the Altera advisory ASA-0002.

A low-privileged local user on a workstation that has Quartus Prime Standard Edition installed plants a malicious library/binary in a directory that the software searches when loading components (CWE-427 uncontrolled search path element). When a higher-privileged user later launches or operates Quartus Prime, the attacker's code is loaded and executes with the victim's elevated privileges. No public exploit code is identified at time of analysis, and the high complexity plus required user interaction make this an opportunistic rather than reliable attack.