Intel QAT Drivers CVE-2026-20771

Q: What is the CVSS score of CVE-2026-20771?

CVE-2026-20771 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29526 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-05-12 intel

GHSA-6g5m-9qxp-xmv7

Denial Of Service Microsoft Intel Null Pointer Dereference Intel R Qat Software Drivers For Windows

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Local low-privileged access crashes user-mode driver component; scope unchanged as impact is confined to the local QAT service with no lateral effect on other systems.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:23 vuln.today

CVSS changed

May 12, 2026 - 17:22 NVD

6.9 (MEDIUM)

CVE Published

May 12, 2026 - 16:34 nvd

MEDIUM 6.9

CVE Published

May 12, 2026 - 16:34 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

AnalysisAI

Null pointer dereference in Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 permits a low-privileged authenticated local user to crash the driver's Ring 3 user-mode component, causing a denial of service with high availability impact and minor confidentiality exposure. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, EPSS sits at 0.01% (3rd percentile), and SSVC classifies exploitation status as none. Real-world risk is constrained to environments with Intel QAT explicitly deployed, which is typical of data-center and high-performance computing workloads rather than general enterprise endpoints.

Technical ContextAI

Intel QAT (Quick Assist Technology) is a hardware-accelerated driver package for Windows that offloads cryptographic operations and data compression to dedicated Intel silicon. The affected component resides in Ring 3 (user-mode application space), which distinguishes it from kernel-mode driver vulnerabilities - a null pointer dereference here results in an application or service crash rather than a kernel panic or privilege escalation. CWE-476 (Null Pointer Dereference) arises when code dereferences a pointer that was never validated against NULL before use; in Windows user-mode driver interactions, the OS will raise an access violation, terminating the process or service that invoked the faulty code path. The CPE string cpe:2.3:a:n/a:intel(r)_qat_software_drivers_for_windows:*:*:*:*:* confirms all versions of the Intel QAT Windows software driver package prior to 1.13 are in scope.

RemediationAI

Vendor-released patch: Intel QAT software drivers for Windows version 1.13 addresses this vulnerability. Organizations should upgrade to version 1.13 or later per Intel Security Advisory INTEL-SA-01387 at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01387.html. If immediate patching is operationally infeasible, restrict which user accounts have local interactive or remote desktop access to systems running Intel QAT drivers, since exploitation requires an authenticated low-privileged local session - reducing local account proliferation on QAT-enabled hosts directly limits attacker opportunity. Additionally, consider monitoring for unexpected crashes or restarts of QAT-related Windows services as a detection signal. These compensating controls do not eliminate the vulnerability but raise the bar for exploitation until the patch can be applied.