Intel QuickAssist Technology CVE-2026-20714

Exploitation requires the Intel QuickAssist Technology (QAT) software driver for Windows (any version before 1.13) to be installed and reachable from a Ring 3 user application on the target host, plus an authenticated local account (PR:L) - the attacker interacts with the QAT user-mode driver interface locally. Limiting factors: the vulnerability is not remotely reachable (AV:L, local access only), it requires a valid authenticated user rather than anonymous access, and it only affects hosts that actually have the Windows QAT driver deployed (a specialized accelerator not present on typical endpoints). No user interaction is needed (UI:N) and complexity is low (AC:L), so once a local foothold exists the barrier to exploitation is minimal.

The signals are internally consistent and point to a real but non-urgent local risk. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a low-complexity, locally-accessible, authenticated attack with no user interaction and full confidentiality/integrity/availability impact on the vulnerable system - hence the 8.5 severity and SSVC 'Technical Impact: total'. However, exploitation-likelihood signals are all low: EPSS is 0.01% (3rd percentile), SSVC 'Exploitation: none' and 'Automatable: no', not on CISA KEV, and no POC is referenced. The local attack vector (AV:L) and required authentication (PR:L) meaningfully limit blast radius - an attacker must already have a foothold as a valid user on the host. Net assessment: a legitimate patch-worthy privilege-escalation issue for systems that actually run QAT on Windows, but not an emergency; it is a high-CVSS finding whose real-world exploitation probability is currently low. No conflicting data was observed - description (local access, authenticated user, low complexity) aligns with the CVSS 4.0 vector.

An attacker who already has an ordinary authenticated account on a Windows server running the Intel QAT drivers invokes the vulnerable Ring 3 driver interface with crafted input that triggers the out-of-bounds write, corrupting memory to gain elevated privileges. No user interaction is required and attack complexity is low, but the attacker must first have local access as a valid user; no public exploit code has been identified at time of analysis.