EUVD-2026-29521
GHSA-xv9x-vj9p-xq8g
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with high complexity, low privilege, and required user interaction; scope unchanged as no subsequent system impact is described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Incorrect default permissions for some Intel(R) NPU Driver software installers before version 32.0.100.4511 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
AnalysisAI
Privilege escalation in Intel NPU Driver software installers before version 32.0.100.4511 stems from incorrect default permissions applied to Ring 3 (user-space) components during installation, classified under CWE-276. A local authenticated low-privileged user on an affected system can exploit these misconfigured permissions under high-complexity conditions - requiring specific attack prerequisites and active user interaction - to achieve full confidentiality, integrity, and availability compromise of the vulnerable system. No active exploitation is confirmed (not in CISA KEV), EPSS is at the 1st percentile (0.01%), and SSVC designates exploitation status as none, indicating this is a theoretical but not currently weaponized risk.
Technical ContextAI
The vulnerability affects Intel NPU (Neural Processing Unit) Driver software installers, identified via CPE as cpe:2.3:a:n/a:intel(r)_npu_driver_software_installers. Intel NPUs are AI-acceleration hardware blocks integrated into newer Intel processor families. CWE-276 (Incorrect Default Permissions) indicates that the installer sets overly permissive access controls on files or directories it deploys into Ring 3 (user application space), allowing unprivileged processes to read, write, or replace those artifacts. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:A) confirms this is a local, high-complexity attack requiring specific attack target prerequisites (AT:P) and active user interaction. The scope impact is confined to the vulnerable system itself (SC:N/SI:N/SA:N), with no lateral system compromise implied.
RemediationAI
The primary fix is to upgrade to Intel NPU Driver software installer version 32.0.100.4511 or later, as confirmed by Intel Security Advisory INTEL-SA-01424 available at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01424.html. Organizations should obtain the updated installer through Intel's official driver download channels and redeploy on all affected endpoints. As a compensating control prior to patching, administrators can restrict write access to the NPU driver installation directory using OS-level access control lists (ACLs), ensuring only SYSTEM or Administrator accounts have write permissions to the installed files - reducing the risk that a low-privileged user can place malicious payloads. Note that ACL hardening may need to be reapplied after any driver reinstallation or update cycle. No additional workarounds are documented in available references.
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today