Intel Open VKL CVE-2026-21399

Exploitation requires a local authenticated user account with low privileges (PR:L, AV:L per CVSS 4.0 vector) on a system where an Intel Open VKL-based application is installed and accessible. The description explicitly states no special internal knowledge is needed and no non-default attack requirements apply (AT:N). No user interaction from a victim is required (UI:N). Limiting factors: the attacker must have an existing local OS session - remote unauthenticated exploitation is not possible. The impact is restricted to denial of service against the vulnerable application process; kernel or other process compromise is not indicated. Confidentiality is entirely unaffected (VC:N).

The CVSS 4.0 base score of 6.9 (Medium) accurately reflects a constrained threat profile: AV:L restricts exploitation to users with existing local access, and PR:L requires a low-privilege authenticated account - substantially reducing the attack surface compared to network-reachable or unauthenticated flaws. The impact is confined to denial of service (VA:H) with negligible integrity effect (VI:L) and no confidentiality exposure (VC:N), ruling out data theft or remote code execution. No EPSS score was provided in the source data; exploitation probability cannot be independently assessed from available signals. The vulnerability is not listed in the CISA KEV catalog, and no proof-of-concept code has been identified, indicating no public exploitation activity at time of analysis. Real-world risk is highest in multi-user HPC environments (clusters, shared workstations) where untrusted or semi-trusted local users can invoke Open VKL-based applications; single-user workstations with controlled access present minimal residual risk. The absence of confidentiality or remote impact means this is a genuine medium-priority patch, not an urgent critical remediation for most organizations.

A low-privilege local user on an HPC node or shared scientific workstation running an Intel Open VKL-based rendering application supplies crafted volumetric data or malformed input to the library, triggering the heap-based buffer overflow. The overflow corrupts heap state within the application process, causing it to crash and resulting in denial of service for any active rendering jobs or sessions. No public proof-of-concept exists, but the low attack complexity (AC:L, AT:N) means an attacker with basic knowledge of the library's input handling could reproduce the condition.