EUVD-2026-56503
GHSA-g54g-3444-gcq8
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector and low-privilege authenticated requirement (AV:L, PR:L); high complexity per vendor; passive user interaction maps to UI:R; no scope change yields S:U.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
1DescriptionCVE.org
Untrusted search path for some Battery Life Diagnostic Tool software before version 2.9.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present with special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
AnalysisAI
Local privilege escalation in Intel Battery Life Diagnostic Tool Software before version 2.9.0 stems from an untrusted search path (CWE-426), enabling a malicious binary or DLL to be loaded in place of a legitimate dependency when the tool executes. An authenticated local attacker with write access to a directory in the application's search path can achieve full system compromise (confidentiality, integrity, and availability all rated High on the vulnerable system) by waiting for a legitimate user to passively trigger the tool. Intel has released a fix in version 2.9.0 via advisory INTEL-SA-01453; no public exploit or CISA KEV listing is present at time of analysis.
Technical ContextAI
CWE-426 (Untrusted Search Path) describes a class of vulnerability where software locates and loads executables or libraries from directories that may be under attacker influence - classically DLL hijacking on Windows or PATH-manipulation on POSIX systems. The affected component operates in Ring 3 (user application space), per the description, meaning the flaw resides entirely in user-mode code rather than a kernel driver, which bounds the initial exploitation footprint to user-mode privilege escalation. The CPE string cpe:2.3:a:n/a:battery_life_diagnostic_tool_software identifies this as an application-layer product. When the diagnostic tool launches and resolves its dependencies, it searches one or more directories without sufficient validation of their trustworthiness, allowing a lower-privileged attacker to preposition a malicious binary that the tool subsequently loads with whatever elevated context it inherits.
RemediationAI
The primary fix is to upgrade Intel Battery Life Diagnostic Tool Software to version 2.9.0 or later, as directed by Intel Security Advisory INTEL-SA-01453 at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01453.html. If immediate patching is not feasible, apply the following compensating controls: restrict write permissions on all directories listed in the system PATH and in the application's installation directory to administrators only - this directly removes the attacker's ability to plant a malicious binary, though it may break legitimate software that writes to those paths. Additionally, run the diagnostic tool under a least-privilege service account that cannot be accessed by ordinary users, reducing the attack surface. Avoid scheduling the tool to run in contexts where untrusted users share the filesystem. These workarounds reduce but do not eliminate risk; patching to 2.9.0 remains the definitive resolution.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-426 – Untrusted Search Path
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today