Intel HLS Compiler CVE-2025-13670

Exploitation requires: (1) the target running on Windows with the Intel/Altera High Level Synthesis Compiler installed; (2) the attacker having local write access to a directory that appears in the DLL search order used by the i++ command (consistent with AV:L and PR:L); (3) placing a malicious DLL with a name the i++ command resolves via an uncontrolled/insecure search path (CWE-427); and (4) a user actively invoking the i++ command so the planted DLL is loaded (UI:A). Limiting factors that reduce realistic risk: no remote vector (local only), high attack complexity (AC:H) plus a required attack precondition (AT:P), the need for pre-existing low-level privileges, and mandatory user interaction - so this cannot be exploited against default configurations without an existing foothold and a triggering developer action.

This is a low-to-moderate real-world priority despite a CVSS 4.0 base score of 5.4. All exploitability signals point to a hard-to-weaponize, locally-scoped issue: the vendor CVSS 4.0 vector is AV:L (local), AC:H (high complexity), AT:P (a specific attack precondition must be present), PR:L (attacker needs some existing privileges), and UI:A (an active, deliberate user action is required to trigger it). These five constraints stack, meaning successful exploitation requires an attacker who already has a foothold on the Windows host plus a cooperating or deceived user running the i++ command. Corroborating signals agree: EPSS is 0.12% (2nd percentile), indicating near-negligible predicted exploitation, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced. The only upside for an attacker is the high technical impact - VC:H/VI:H/VA:H implies full code execution in the user's context once the DLL is loaded. There is no signal conflict between the probability signals (all low), but note the impact metrics (full CIA) contrast with the 'Information Disclosure' tag, which understates the actual code-execution impact. Bottom line: a genuine vulnerability worth patching in FPGA developer toolchains, but not an urgent, widely-exploited threat.

An attacker who can already write files to a directory in the DLL search path of the Intel/Altera High Level Synthesis Compiler plants a malicious DLL matching a name the i++ command loads. When a developer later runs i++ (the required active user interaction) from or against that location on Windows, the planted DLL is loaded and the attacker's code executes in the developer's security context. No public exploit code is identified at time of analysis, and the high attack complexity plus required precondition make reliable exploitation non-trivial.