Intel AI Playground EUVD-2025-209795

Exploitation requires all of the following simultaneously: (1) local access to the target system, (2) the attacker must have at least low-privilege (authenticated) access to write to a directory in the AI Playground search path, (3) the specific attack conditions flagged by AT:P must be present - implying a non-default or environmentally specific configuration of the search path or writable directory, (4) a legitimate authenticated user must actively interact with the AI Playground application to trigger the vulnerable path resolution (UI:A), and (5) attack complexity is rated high (AC:H), meaning successful exploitation is not straightforward and may require precise timing or environment staging. Exploitation is bounded to the local system - no network-based delivery is possible (AV:L). Remote unauthenticated exploitation is ruled out by the CVSS vector. The requirement for user interaction and specific attack conditions significantly limits opportunistic or automated exploitation.

Real-world risk is moderate-to-low despite the high CIA impact on the vulnerable system. The CVSS 4.0 score of 5.4 reflects the cumulative constraints: AV:L (local access only), AC:H (high complexity), AT:P (attack requirements present), PR:L (requires authenticated user), and UI:A (requires active user interaction). EPSS of 0.01% at the 3rd percentile signals extremely low probability of observed exploitation in the wild. SSVC rates exploitation as none and automatable as no - consistent with the manual, multi-condition nature of this attack. SSVC technical impact is rated total, which aligns with VC:H/VI:H/VA:H. The vulnerability is not listed in CISA KEV and no POC has been identified. Net assessment: this is a genuine local privilege escalation with high technical impact, but the combination of local access, high complexity, active user interaction, and non-default attack conditions dramatically constrains real-world exploitability. Organizations with untrusted local users or shared workstations running AI Playground are the primary risk population.

A local low-privileged attacker sharing a workstation with a legitimate AI Playground user plants a malicious DLL or executable in a writable directory that falls within the application's uncontrolled search path. When the legitimate user subsequently launches or uses AI Playground - providing the required active user interaction - the application resolves the search path and loads the attacker's malicious file instead of the intended library, executing arbitrary code with the privileges of the application or the user session. No public proof-of-concept has been identified at time of analysis.