Skip to main content

Intel Processors CVE-2025-35979

| EUVDEUVD-2025-209791 MEDIUM
Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution (CWE-1423)
2026-05-12 intel GHSA-f5vw-x3gp-vr4c
Information Disclosure Intel N A Intel R Processors
6.8
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.6 MEDIUM

Local access within guest VM (AV:L), high complexity timing attack (AC:H), low-privilege guest execution (PR:L), scope change to host/co-tenant (S:C), confidentiality only.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Red Hat
5.6 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Jul 23, 2026 - 22:16 vuln.today
CVSS changed
May 12, 2026 - 17:22 NVD
6.8 (MEDIUM)
CVE Published
May 12, 2026 - 16:35 nvd
MEDIUM 6.8
CVE Published
May 12, 2026 - 16:35 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) Processors within VMX non-root (guest) operation may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.

AnalysisAI

Transient execution information disclosure in Intel processors allows unprivileged guest VM code to leak sensitive data from co-resident workloads by exploiting shared microarchitectural predictor state during VMX non-root operation. Confidentiality impact is rated high at both the vulnerable-system and subsequent-system level, indicating potential cross-VM or host-to-guest data leakage consistent with Spectre-class side-channel behavior. No public exploit has been identified at time of analysis, EPSS sits at the 3rd percentile, and CISA SSVC rates exploitation as none - but the cross-boundary confidentiality impact makes this relevant to any multi-tenant virtualized environment running affected Intel silicon.

Technical ContextAI

CWE-1423 (Sharing of Microarchitectural Resources) identifies the root cause: microarchitectural resources such as branch predictors or indirect branch target buffers are shared across execution contexts that should be isolated. In VMX non-root operation - the CPU mode used by guest virtual machines under Intel VT-x - these shared predictor structures can be poisoned or read by an unprivileged attacker to influence speculative execution and subsequently expose data through side-channel observations (e.g., cache-timing). This is architecturally similar to Spectre v2 (Branch Target Injection) and related transient execution attack families. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L) confirms the local, complex, guest-side nature of the attack. Affected CPE is cpe:2.3:a:n/a:intel(r)_processors:*:*:*:*:*:*:*:*, indicating broad processor family scope - Intel's advisory INTEL-SA-01420 should be consulted for exact processor model lists.

RemediationAI

The vendor has confirmed a patch is available - consult Intel Security Advisory INTEL-SA-01420 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01420.html) for microcode updates and exact affected processor model lists. For Linux-based systems, Red Hat and SUSE have published their own advisories (referenced via tags) that will deliver microcode via kernel or microcode package updates; apply the latest kernel and microcode_ctl or intel-microcode packages available for your distribution. As a compensating control while patching, hypervisor-level mitigations such as restricting cross-VM predictor sharing (e.g., IBRS, eIBRS, or STIBP enforcement where supported) can reduce the attack surface - note these may carry a measurable CPU performance penalty (typically 1-15% depending on workload). In high-sensitivity multi-tenant environments, consider physical isolation of workloads on separate sockets or hosts until microcode is deployed.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2025-35979 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy