EUVD-2026-29531
GHSA-m6jr-w5q8-7x85
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local driver bug requiring existing high host privilege (AV:L/PR:H), low complexity, no user interaction; out-of-bounds write corrupts data and crashes the host (I:H/A:H) with no confidentiality impact (C:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Out-of-bounds write for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.
AnalysisAI
Local privilege-driven data corruption in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 allows a privileged local adversary to trigger an out-of-bounds write (CWE-787) in a Ring 1 device driver, causing denial of service and integrity loss. The flaw affects the vulnerable system's integrity and availability (both High) with no confidentiality impact, and carries a CVSS 4.0 base score of 8.3. There is no public exploit identified at time of analysis, and the EPSS probability is negligible at 0.01%.
Technical ContextAI
The affected component is Intel's Data Center Graphics Driver, a kernel-adjacent device driver executing in the ESXi Ring 1 (device driver) privilege layer rather than in unprivileged user space. The root cause is CWE-787 (Out-of-bounds Write): the driver writes past the bounds of an allocated buffer, corrupting adjacent memory. Because the code runs within the hypervisor's driver layer, memory corruption there can destabilize the driver or the surrounding system state rather than being confined to a single guest process. The single CPE, cpe:2.3:a:n/a:intel(r)_data_center_graphics_driver_for_vmware_esxi_software:*, identifies the driver software itself as the sole affected product; no specific hardware SKU is enumerated in the intelligence provided.
RemediationAI
Vendor-released patch: version 2.0.2. Upgrade the Intel Data Center Graphics Driver for VMware ESXi to 2.0.2 or later per Intel advisory Intel-SA-01402 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01402.html), which is the primary and definitive fix. Because exploitation requires an already-privileged local actor, effective compensating controls until the driver is updated focus on limiting who holds host-level privilege: restrict and audit ESXi administrative/root access, enforce lockdown mode on ESXi hosts to constrain direct host operations, and limit which trusted management accounts can load or interact with kernel drivers - the trade-off being tighter operational access and more change-management overhead. If the affected Intel graphics driver is not operationally required on a given host, removing or not loading it eliminates the attack surface entirely, at the cost of losing that GPU's accelerated functionality.
Local privilege escalation in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileg
Local privilege-abusing denial of service and information disclosure in the Intel Data Center Graphics Driver for VMware
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today