EUVD-2026-56512
GHSA-4942-r77j-8wv7
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only access (AV:L), race condition timing requirement (AC:H), authenticated low-privilege user (PR:L); no confidentiality impact, low integrity, high availability consistent with driver crash.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
2DescriptionCVE.org
Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
AnalysisAI
Denial of service via a TOCTOU race condition in the Intel NPU Driver for Windows affects all current versions operating at Ring 1 (device driver layer). An authenticated local attacker with low privileges can exploit a window between the driver's resource state check and its use, resulting in high availability impact and low integrity impact to the vulnerable system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local authenticated access to the target Windows system with at least low-privilege credentials (PR:L); (2) the Intel NPU Driver for Windows to be installed and active - this is specific to Intel Core Ultra (Meteor Lake-generation and later) hardware; (3) high attack complexity, meaning the attacker must precisely time concurrent operations to win the TOCTOU race, which is non-deterministic and environment-dependent; and (4) specific attack requirements (AT:P) as enumerated in the CVSS 4.0 vector, indicating conditions beyond the default that must be present, though the description does not specify these precisely beyond 'attack requirements are present.' Exploitation is limited by: the requirement for prior local authentication (not remotely exploitable), the statistical difficulty of reliably winning a race condition (AC:H), hardware dependency on Intel NPU-equipped systems, and the absence of scope change (no privilege escalation to kernel or other systems is confirmed). Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L) paints a constrained threat picture: exploitation requires local authenticated access, high attack complexity to win the race condition, and specific attack requirements (AT:P) indicating non-default or situationally dependent conditions must be met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the updated Intel NPU Driver for Windows as released under Intel Security Advisory INTEL-SA-01456, available at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01456.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today