Intel Processors CVE-2026-20917

Q: What is the CVSS score of CVE-2026-20917?

CVE-2026-20917 has a CVSS 4.0 base score of 4.0 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-56822 MEDIUM

Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution (CWE-1422)

2026-08-11 secure@intel.com

GHSA-wf2w-hc7r-v7p4

Information Disclosure Intel Suse

4.0

CVSS 4.0 · Vendor: intel

Severity by source

Vendor (intel) PRIMARY

4.0 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local access, high complexity, and Ring 0 privilege required; scope changes to hypervisor layer with high confidentiality impact only.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

SUSE

5.3 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (intel).

CVSS VectorVendor: intel

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:50 vuln.today

CVE Published

Aug 11, 2026 - 18:17 cve.org

MEDIUM 4.0

DescriptionCVE.org

Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0: Hypervisor and Kernel may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.

AnalysisAI

Transient execution information disclosure in Intel processors allows a Ring 0 (kernel or hypervisor level) adversary to leak sensitive data across security boundaries into a subsequent system context. The flaw stems from incorrect data forwarding during speculative execution, a class of hardware-level side-channel vulnerability similar to Spectre-class attacks, requiring local access with high privileges and high attack complexity. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation enables high-confidentiality-impact cross-boundary data exposure, threatening hypervisor isolation guarantees critical in virtualized and cloud environments.

Technical ContextAI

This vulnerability belongs to the transient execution attack class, in which a processor speculatively executes instructions and incorrectly forwards data across privilege or domain boundaries before architectural state is committed. The flaw manifests within Ring 0 contexts - specifically the hypervisor and kernel layers - where incorrect data forwarding during micro-architectural transient operations exposes data from a subsequent system (e.g., the hypervisor layer from a kernel-level attacker). This is conceptually related to Load Value Injection (LVI) and other speculative forwarding attack variants documented in Intel's microarchitecture research. Affected products are described as 'some Intel(R) Processors' per the EUVD entry, with the exact processor family list deferred to the Intel Security Advisory INTEL-SA-01423. No CWE was assigned by NVD, but the root cause class is clearly transient execution improper isolation (analogous to CWE-1264: Hardware Logic with Insecure De-Synchronization between Control and Data Channels). The CVSS 4.0 vector's VC:N/VI:N/VA:N with SC:H/SI:N/SA:N confirms that the attack produces no direct impact on the vulnerable system itself, but achieves high confidentiality compromise of a subsequent, higher-privilege system - consistent with a kernel-to-hypervisor data leakage scenario.

RemediationAI

The primary remediation path is to consult Intel Security Advisory INTEL-SA-01423 at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01423.html and apply any available microcode updates or firmware patches specific to the affected processor families listed therein. Intel typically distributes mitigations for transient execution vulnerabilities via microcode updates deployed through BIOS/UEFI firmware updates or OS-level microcode loader packages (e.g., intel-microcode on Linux distributions, Windows Update). No specific patched microcode version is independently confirmed from the available input data - the exact fix version must be obtained from the Intel advisory. For cloud and virtualization environments where hypervisor isolation is a core trust boundary, prioritize patching hypervisor hosts before guest systems. As a compensating control pending patch application, restrict Ring 0 access to only trusted, audited software components and harden kernel module loading policies (e.g., enforce kernel lockdown mode on Linux, disable unsigned driver loading on Windows). Note that microcode patches for transient execution attacks can carry a measurable performance overhead, particularly on I/O-intensive workloads; operators should benchmark prior to broad rollout.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31