EUVD-2026-56522
GHSA-x695-2c4c-37q2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low-privilege requirement matches description; availability-only high impact consistent with DoS; no scope change, no confidentiality or integrity impact.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
1DescriptionCVE.org
Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Applications may allow a denial of service. Authorized adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
AnalysisAI
Improper input validation in the vLLM Hardware Plugin for Intel Gaudi software (versions before 0.16.0) allows a locally authenticated user to cause a denial of service, crashing or degrading availability of the affected system. The vulnerability operates within Ring 3 (user application space) and requires only low-privilege local access with no user interaction, making it viable for insider threat or compromised-account scenarios. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access and an authenticated user account with at least low-privilege permissions (PR:L, AV:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.8 (Medium) is consistent with the threat model: AV:L requires physical or logical local access, PR:L requires an authenticated user, AC:L indicates low attack complexity, and the impact is limited exclusively to availability (VA:H) with no confidentiality or integrity compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the vLLM Hardware Plugin for Intel(R) Gaudi(R) software to version 0.16.0 or later, as confirmed by Intel's security advisory INTEL-SA-01487 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01487.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today