Which versions of Intel QAT are affected by CVE-2026-20767?

Intel QuickAssist Technology (QAT) drivers for Windows contain a local privilege escalation vulnerability (CVSS 8.5) that allows authenticated users to elevate system privileges, affecting…

How to fix or mitigate CVE-2026-20767?

Within 24 hours, identify and inventory all Windows systems running Intel QAT drivers version 1.13 and earlier, and classify by business criticality. Within 7 days, implement compensating controls including restricting local access to QAT-enabled systems to trusted users only, disabling QAT services where operationally feasible, and enforcing multi-factor authentication for privileged account access on affected systems. Within 30 days, establish continuous audit logging and monitoring for privilege escalation attempts on affected systems, contact Intel PSIRT directly regarding patch availability timelines, and develop a staged deployment plan for driver updates when released.

Intel QAT CVE-2026-20767

Q: What is the CVSS score of CVE-2026-20767?

CVE-2026-20767 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29546 HIGH

Improper Input Validation (CWE-20)

2026-05-12 secure@intel.com

GHSA-m8mm-9cp6-x7h3

Privilege Escalation Microsoft Intel Quickassist Technology

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local authenticated attacker (AV:L, PR:L) with no user interaction and low complexity achieves full local compromise (C/I/A:H), scope unchanged as impact stays within the host.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:19 vuln.today

CVE Published

May 12, 2026 - 18:16 nvd

HIGH 8.5

DescriptionCVE.org

Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

AnalysisAI

Local privilege escalation in Intel QuickAssist Technology (QAT) software drivers for Windows before version 1.13 lets an authenticated low-privileged user elevate to higher privileges through improper input validation in a Ring 3 user-application code path. The flaw was reported by Intel PSIRT (INTEL-SA-01387) and carries a CVSS 4.0 base of 8.5, but there is no public exploit identified at time of analysis and EPSS is a low 0.03% (8th percentile). SSVC scores exploitation as none and not automatable, consistent with a driver bug that requires prior local, authenticated access.

Technical ContextAI

Intel QuickAssist Technology (QAT) is a hardware acceleration platform that offloads symmetric/asymmetric cryptography and compression from the CPU to dedicated Intel accelerators, exposed to software through a driver stack. On Windows, the QAT driver bridges Ring 3 user applications to the accelerator, and per the CPE 'cpe:2.3:a:intel:quickassist_technology:*:*:*:*:*:windows:*:*' the affected component is the Windows QAT software driver. The root cause is CWE-20 (Improper Input Validation): the driver interface does not adequately validate input supplied from user-mode applications, allowing a crafted request from a low-privileged process to influence privileged behavior and achieve escalation of privilege on the local system.

RemediationAI

Vendor-released patch: version 1.13 - upgrade the Intel QAT software drivers for Windows to version 1.13 or later on all hosts equipped with Intel QAT accelerators, following Intel advisory INTEL-SA-01387 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01387.html). Because exploitation requires an authenticated local user, effective compensating controls until patching are to restrict interactive and local logon rights on QAT-enabled servers to trusted administrators, enforce least privilege so untrusted code cannot run locally, and monitor for unexpected use of the QAT driver interface; the trade-off is that these controls constrain multi-tenant or shared-host usage and do not remove the underlying flaw. There is no documented feature toggle to disable the vulnerable path short of removing/unloading the QAT driver, which would disable hardware crypto/compression acceleration and force a software fallback. See also NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-20767) and VulDB (https://vuldb.com/vuln/363301).