EUVD-2026-56515
GHSA-89w3-r78p-gf49
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privilege required; heap overflow yields high availability crash with low integrity side-effect and no confidentiality impact; scope unchanged as damage is confined to the application process.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
1DescriptionCVE.org
Heap-based buffer overflow for the Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
AnalysisAI
Heap-based buffer overflow in Intel Open Volume Kernel Library (Open VKL) before version 2.0.2 allows a local authenticated attacker with low privileges to cause denial of service against applications consuming the library. Operating entirely in Ring 3 (user space), the flaw requires no user interaction and carries low attack complexity, making it straightforward to trigger for any local account on an affected system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local authenticated user account with low privileges (PR:L, AV:L per CVSS 4.0 vector) on a system where an Intel Open VKL-based application is installed and accessible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.9 (Medium) accurately reflects a constrained threat profile: AV:L restricts exploitation to users with existing local access, and PR:L requires a low-privilege authenticated account - substantially reducing the attack surface compared to network-reachable or unauthenticated flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Intel Open VKL to version 2.0.2 or later, which is the vendor-confirmed fix per Intel advisory INTEL-SA-01459 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01459.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today