Quartus Prime Pro CVE-2025-13668

Exploitation requires an uncontrolled library/DLL search-path element (CWE-427): the attacker must already have local, low-privileged access (PR:L) to a system where Quartus Prime Pro is installed, and must be able to write a malicious library into a directory Quartus searches before the legitimate one. Exploitation further depends on a legitimate higher-privileged user actively launching Quartus (UI:A), on a specific attack precondition being present (AT:P), and is rated high-complexity (AC:H). Limiting factors: no remote vector (local only), requires existing authentication/foothold, requires victim interaction, and non-trivial conditions must align - substantially narrowing realistic exploitation despite the high C/I/A impact.

This is a medium-severity (CVSS 4.0 base 5.4), locally-exploitable privilege escalation in Intel/Altera Quartus Prime Pro Edition, mapped to CWE-427 (Uncontrolled Search Path Element), i.e. a classic library/DLL search-path hijack. Every exploitation signal points AWAY from urgency: the CVSS 4.0 vector is AV:L (local only), AC:H (high complexity), AT:P (a specific attack requirement must be present), PR:L (attacker already needs low-privilege local access), and UI:A (a legitimate user must actively run the software). EPSS is 0.11% (1st percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'high' impact flags (VC:H/VI:H/VA:H) are what keep the score off the floor, but they only materialize AFTER a local attacker clears the access, complexity, attack-requirement, and user-interaction hurdles. Net: this is a genuinely-low-real-risk, high-ceiling-impact issue suitable for routine patch-cycle remediation, not emergency action. No conflicting signals were found; note only the vendor attribution nuance that the CPE labels the vendor 'intel' while the advisory is hosted by Altera (the spun-off FPGA business now owning Quartus) - both are legitimate, not a data error.

A low-privileged local user on a shared engineering workstation plants a malicious DLL or shared library in a directory that Quartus Prime Pro searches before the trusted location. When an engineer or administrator subsequently launches Quartus (the required active user interaction), the planted library is loaded and the attacker's code executes with that higher-privileged user's rights. No public exploit code is known, and the high attack complexity plus required attack precondition make reliable exploitation non-trivial.