Intel QAT Drivers CVE-2026-20905

Q: What is the CVSS score of CVE-2026-20905?

CVE-2026-20905 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29534 MEDIUM

Improper Input Validation (CWE-20)

2026-05-12 intel

GHSA-hwmf-pqmc-6cm6

Denial Of Service Microsoft Intel Intel R Qat Software Drivers For Windows

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.6 MEDIUM

Local-only attack via authenticated low-privilege user with no complexity or interaction; availability high per description, scope unchanged as SC/SI/SA are all none.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:18 vuln.today

CVSS changed

May 12, 2026 - 17:22 NVD

6.9 (MEDIUM)

CVE Published

May 12, 2026 - 16:34 nvd

MEDIUM 6.9

CVE Published

May 12, 2026 - 16:34 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

AnalysisAI

Denial of service in Intel Quick Assist Technology (QAT) software drivers for Windows before version 2.6 can be triggered by a low-privileged local user through improper input validation at the Ring 3 (user application) boundary. An authenticated but unprivileged local attacker can cause high availability impact to the affected system with low complexity, also producing minor confidentiality and integrity side effects. No public exploit code has been identified at time of analysis, and SSVC assessment classifies exploitation as none with non-automatable attack surface.

Technical ContextAI

Intel QAT (Quick Assist Technology) provides hardware-accelerated cryptographic and data compression offload capabilities, commonly deployed in data center and server workloads. The affected component is the Windows kernel-mode software driver stack that bridges Ring 3 (unprivileged user applications) to the underlying QAT hardware. CWE-20 (Improper Input Validation) indicates the driver fails to adequately validate data passed from user-space before processing it - a classic trust boundary violation where the kernel-mode driver incorrectly trusts caller-supplied input from Ring 3. CPE data confirms the affected scope is cpe:2.3:a:n/a:intel(r)_qat_software_drivers_for_windows covering all versions before 2.6. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms local, low-complexity exploitation requiring only low-privilege user access with no attack requirements and no user interaction needed.

RemediationAI

The primary fix is to upgrade Intel QAT software drivers for Windows to version 2.6 or later, available via the Intel advisory at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01387.html. If immediate upgrade is not possible, limit local user access on systems running QAT-dependent workloads - since exploitation requires an authenticated local session (PR:L), restricting interactive logon rights and removing unnecessary local accounts reduces exposure. Restricting which processes can invoke QAT driver interfaces through Windows application allow-listing (e.g., AppLocker or WDAC policies) would limit the ability of untrusted Ring 3 applications to pass malformed input to the driver. These compensating controls introduce operational overhead for managing allow-list policies and may require testing against legitimate QAT workloads before deployment.