Intel QAT CVE-2026-20767

Exploitation requires the target host to have the Intel QAT software driver for Windows (before version 1.13) installed - i.e., a system provisioned with Intel QuickAssist Technology acceleration - and the attacker must already hold an authenticated, low-privileged local account able to execute code (PR:L, AV:L, UI:N). The specific trigger is sending unvalidated/malformed input from a Ring 3 user application to the QAT driver interface. Limiting factors: no remote exploitation (local access only), attacker must be pre-authenticated, and the vulnerable QAT Windows driver must actually be present - hosts without Intel QAT hardware/drivers are not exploitable, which sharply narrows the real-world attack surface.

The signals point to a genuine but low-urgency issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) yields 8.5 with total technical impact (full loss of confidentiality, integrity, and availability of the vulnerable system), but the local attack vector plus PR:L means an attacker must already have authenticated code execution on the host - this is an escalation primitive, not an initial-access or remotely wormable bug. EPSS is very low (0.03%, 8th percentile), the vulnerability is not in CISA KEV, and CISA SSVC marks Exploitation: none and Automatable: no, all reinforcing that no active exploitation or automation is expected. The one high signal (Technical Impact: total) is about severity-if-exploited, not likelihood. Net: prioritize as routine patch-cycle hardening for the limited fleet running QAT on Windows, not as an emergency. No conflicting data was found; CVSS scope of exploitation (local, authenticated) is consistent with the description.

An attacker who has already obtained a low-privileged authenticated foothold on a Windows server with Intel QAT installed (for example, a limited service account or a compromised standard user) runs a crafted user-mode program that sends malformed input to the QAT driver interface. The improper input validation lets the request drive privileged behavior, elevating the attacker to full system control. No public exploit is identified at time of analysis and no user interaction is required.