How to fix or mitigate CVE-2026-20794?

Within 24 hours: inventory all ESXi deployments to identify systems using Intel Data Center Graphics Driver versions prior to 2.0.2, and implement strict administrative access controls limiting privileged user access to only essential personnel. Within 7 days: disable the Intel Data Center Graphics Driver on systems where GPU graphics are not required for workload operations, and establish monitoring for suspicious driver-related activity and privilege escalation attempts. Within 30 days: establish a process to monitor Intel and VMware security advisories for patch availability, maintain current inventory of affected systems, and prepare a remediation plan for immediate deployment upon vendor patch release.

Intel R Data Center Graphics Driver For Vmware Esxi Software CVE-2026-20794

Q: What is the CVSS score of CVE-2026-20794?

CVE-2026-20794 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29530 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-05-12 intel

GHSA-g43p-fpv4-prfq

Privilege Escalation VMware Intel RCE Buffer Overflow Intel R Data Center Graphics Driver For Vmware Esxi Software

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:20 vuln.today

CVSS changed

May 12, 2026 - 17:22 NVD

9.3 (CRITICAL)

CVE Published

May 12, 2026 - 16:34 nvd

CRITICAL 9.3

CVE Published

May 12, 2026 - 16:34 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Buffer overflow for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.

AnalysisAI

Local privilege escalation in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger a Ring 1 device-driver buffer overflow to execute arbitrary code and take total control of the host. The flaw carries a CVSS 4.0 base score of 9.3 with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis, and the EPSS score is negligible at 0.01% (3rd percentile), consistent with the SSVC verdict of no known exploitation.