Skip to main content

Intel Processors CVE-2026-20760

| EUVDEUVD-2026-56489 MEDIUM
Improper Handling of Overlap Between Protected Memory Ranges (CWE-1260)
2026-08-11 intel GHSA-3v3f-887c-p9f4
Privilege Escalation Intel N A Suse Intel R Processors
6.8
CVSS 4.0 · Vendor: intel
Share

Severity by source

Vendor (intel) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Local low-privilege access exploits Ring 0 microcode flaw; scope change at hypervisor level implies full CIA impact per CVE description.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (intel).

CVSS VectorVendor: intel

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 11, 2026 - 21:55 vuln.today
CVE Published
Aug 11, 2026 - 16:25 cve.org
MEDIUM 6.8

DescriptionCVE.org

Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring 0: Hypervisor may allow an escalation of privilege. Authorized adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

AnalysisAI

Privilege escalation in Intel processor microcode stems from improper handling of overlap between protected memory ranges at the Ring 0 hypervisor privilege level, tracked as CVE-2026-20760 and EUVD-2026-56489. Exploitation requires local, low-privilege access to a system running an affected Intel processor, allowing an authorized adversary to escalate privileges or disrupt hypervisor availability without user interaction. Intel has published advisory INTEL-SA-01441 covering this issue; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the hypervisor-level attack surface warrants priority treatment in virtualized environments.

Technical ContextAI

The root cause is classified under CWE-1260 (Improper Handling of Overlap Between Protected Memory Ranges), a hardware-level flaw class where overlapping protected memory regions allow the access controls of one region to be bypassed or corrupted via the other. The vulnerability resides in Intel processor microcode - the immutable firmware layer embedded in CPU silicon that implements instruction-set semantics and hardware memory protection primitives. Ring 0 is the most privileged execution domain in the x86 protection ring hierarchy and is where hypervisors operate; flaws at this layer can undermine the trust boundary between the hypervisor and all hosted guest virtual machines. The affected CPE (cpe:2.3:a:n/a:intel(r)_processors:*:*:*:*:*:*:*:*) uses a broad wildcard covering multiple Intel processor families, with specific model SKUs enumerated only in vendor advisory INTEL-SA-01441.

RemediationAI

The primary remediation is to apply Intel's microcode update as published in advisory INTEL-SA-01441 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01441.html); microcode updates are typically distributed via BIOS/UEFI firmware updates from system OEMs or, on Linux-based systems, through the intel-microcode package maintained by distributions such as Debian, Ubuntu, and Red Hat. Administrators should identify their processor family using tools such as cpuid or /proc/cpuinfo and cross-reference against the Intel advisory to confirm applicability before scheduling a maintenance window requiring system reboot. A specific patched microcode revision number is not independently confirmed from the available intelligence - consult INTEL-SA-01441 directly for exact fix versions. Where immediate firmware updates are operationally infeasible, compensating controls include restricting local shell access to the hypervisor host, minimizing the number of accounts with low-privilege hypervisor-adjacent access, and enabling hardware-enforced virtualization isolation features (such as Intel VT-d/IOMMU) to limit lateral impact - though none of these eliminate the underlying microcode flaw.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-1260 – Improper Handling of Overlap Between Protected Memory Ranges

View all
CVE-2025-1937 HIGH POC
7.5
CVE-2018-25240 MEDIUM POC
6.9
CVE-2018-25238 MEDIUM POC
6.9
CVE-2019-25592 MEDIUM POC
6.9
CVE-2019-25572 MEDIUM POC
6.9
CVE-2019-25602 MEDIUM POC
6.8
CVE-2019-25559 MEDIUM POC
6.8
CVE-2019-25585 MEDIUM POC
6.2

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-20760 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy