EUVD-2026-29531
GHSA-m6jr-w5q8-7x85
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged local access to ESXi host
-
DeliveryInvoke Intel graphics driver with crafted input
-
ExploitTrigger out-of-bounds write in Ring 1 driver
-
ExecutionCorrupt adjacent kernel memory
-
ImpactCause data corruption or denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a VMware ESXi host running the Intel Data Center Graphics Driver at a version before 2.0.2, and the attacker must already hold High privileges (PR:H) - described as a 'system software adversary with a privileged user.' No user interaction is required (UI:N) and attack complexity is low (AC:L/AT:N), but the High-privilege prerequisite is the dominant limiting factor: an unprivileged local user or any remote actor cannot exploit this. The affected driver must actually be installed and loaded on the host; hosts not using this Intel graphics driver, or already on 2.0.2+, are not exposed. Impact is limited to integrity and availability (data corruption / denial of service) with no confidentiality exposure. |
| Impact | The signals are internally consistent and point to a genuine-but-bounded risk. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) requires local access and High privileges, meaning the attacker must already be a privileged/system-software actor on the host - this substantially limits the population of viable attackers and is why the 8.3 score, though 'High', is not a drop-everything network-exploitable emergency. EPSS is 0.01% (2nd percentile) and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial, all reinforcing low real-world exploitation pressure. There is no KEV listing and no public exploit identified. The impact profile is asymmetric: VC:N (no confidentiality loss) but VI:H/VA:H (high integrity and availability loss), consistent with a memory-corruption bug usable for data corruption and denial of service rather than data theft. No signals conflict. The one caveat: the description frames impact as 'may allow' / 'potentially', so the maximum-impact (integrity corruption vs. pure crash) outcome is asserted by the CVSS metrics but not demonstrated by a confirmed exploit. |
| Exploit ScenarioDerived | An attacker who has already obtained privileged (system-software / host-admin level) access to an ESXi host invokes the vulnerable Intel graphics driver with crafted input that triggers the out-of-bounds write, corrupting driver or system memory. The result is data corruption and/or a denial of service (driver or host instability). No user interaction is required, but no public exploit code is currently identified, so an attacker would need to develop the trigger independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local privilege-driven data corruption in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 allows a privileged local adversary to trigger an out-of-bounds write (CWE-787) in a Ring 1 device driver, causing denial of service and integrity loss. The flaw affects the vulnerable system's integrity and availability (both High) with no confidentiality impact, and carries a CVSS 4.0 base score of 8.3. There is no public exploit identified at time of analysis, and the EPSS probability is negligible at 0.01%.
RemediationAI
Vendor-released patch: version 2.0.2. Upgrade the Intel Data Center Graphics Driver for VMware ESXi to 2.0.2 or later per Intel advisory Intel-SA-01402 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01402.html), which is the primary and definitive fix. Because exploitation requires an already-privileged local actor, effective compensating controls until the driver is updated focus on limiting who holds host-level privilege: restrict and audit ESXi administrative/root access, enforce lockdown mode on ESXi hosts to constrain direct host operations, and limit which trusted management accounts can load or interact with kernel drivers - the trade-off being tighter operational access and more change-management overhead. If the affected Intel graphics driver is not operationally required on a given host, removing or not loading it eliminates the attack surface entirely, at the cost of losing that GPU's accelerated functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Intel's Data Center Graphics Driver, a kernel-adjacent device driver executing in the ESXi Ring 1 (device driver) privilege layer rather than in unprivileged user space. The root cause is CWE-787 (Out-of-bounds Write): the driver writes past the bounds of an allocated buffer, corrupting adjacent memory. Because the code runs within the hypervisor's driver layer, memory corruption there can destabilize the driver or the surrounding system state rather than being confined to a single guest process. The single CPE, cpe:2.3:a:n/a:intel(r)_data_center_graphics_driver_for_vmware_esxi_software:*, identifies the driver software itself as the sole affected product; no specific hardware SKU is enumerated in the intelligence provided.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Local driver bug requiring existing high host privilege (AV:L/PR:H), low complexity, no user interaction; out-of-bounds write corrupts data and crashes the host (I:H/A:H) with no confidentiality impact (C:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds write for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.
Executive ViewAI
Intel Data Center Graphics Driver in VMware ESXi versions prior to 2.0.2 contains a local privilege-driven memory corruption vulnerability with CVSS 8.3 that can cause denial of service and data integrity loss on affected hypervisors. Although no public exploit has been identified and exploitation probability is negligible at 0.0% EPSS, the high severity and impact on data center infrastructure integrity warrant immediate identification of affected systems and interim access controls.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting local administrative access through role-based access controls and enforcing principle-of-least-privilege for ESXi system accounts, implementing credential isolation to limit who obtains local privileges, and enabling hypervisor kernel audit logging to detect anomalous Ring 1 device driver activity that could indicate exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB