EUVD-2026-29522
GHSA-qmx6-w9c6-prh5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
DeliveryInvoke QuickAssist 8960 Ring 3 software
-
ExploitSupply untrusted pointer value
-
ExecutionTrigger pointer dereference / memory corruption
-
ImpactEscalate privileges on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Untrusted pointer prevention
|
| Exploitation Conditions | Exploitation requires local access to a host that has the Intel QuickAssist Adapter 8960 and its software (before version 1.13) installed, plus an already-authenticated, low-privileged local account (PR:L) able to interact with the adapter's Ring 3 user-application software; no user interaction and no special internal knowledge are needed (AC:L, AT:N, UI:N). Limiting factors that reduce realistic risk: the vector is strictly local (AV:L) - there is no remote/network path - and the attacker must already possess valid credentials and the presence of the specific 8960 adapter software, so systems without this niche accelerator hardware/software are not exposed at all. |
| Impact | Signals are consistent and point to a genuine but not urgent local-escalation issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms local access with low attack complexity, low existing privileges, and no user interaction, with total (VC:H/VI:H/VA:H) impact on the vulnerable system and no subsequent-system impact - hence the elevated 8.5 score. However, EPSS is only 0.01% (3rd percentile) and CISA SSVC scores Exploitation as none and Automatable as no, while rating Technical Impact as total. The picture is coherent: high technical impact if exploited, but no evidence of active or automatable exploitation and no KEV listing. This is a patch-in-normal-cycle priority for organizations that actually deploy the 8960 adapter, not a drop-everything emergency; the local-only vector and required authentication meaningfully constrain real-world risk despite the high base score. |
| Exploit ScenarioDerived | A low-privileged but authenticated user already logged into a server that hosts the Intel QuickAssist Adapter 8960 crafts input that supplies a malicious pointer value to the adapter's Ring 3 user-application software, triggering the untrusted pointer dereference. Because attack complexity is low and no user interaction is needed, the attacker leverages the resulting memory corruption to escalate to higher privileges on the local system. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local privilege escalation in Intel QuickAssist Adapter 8960 software before version 1.13 allows an authenticated, low-privileged user to abuse an untrusted pointer dereference in a Ring 3 user-application component to gain elevated privileges on the host. The flaw yields total impact (high confidentiality, integrity, and availability) on the affected system and carries a CVSS 4.0 base score of 8.5. There is no public exploit identified at time of analysis, and EPSS rates near-term exploitation probability at just 0.01%.
RemediationAI
Vendor-released patch: update the Intel QuickAssist Adapter 8960 software to version 1.13 or later, per Intel advisory INTEL-SA-01387 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01387.html). Because exploitation requires an authenticated local user, effective compensating controls until patching is complete include restricting local and interactive login access to hosts equipped with the 8960 adapter to trusted administrators only, limiting which accounts can load or invoke the QAT user-space software, and monitoring for anomalous local process behavior around the adapter software - with the trade-off that these controls reduce but do not eliminate exposure and may constrain legitimate operators who rely on QAT-accelerated workloads. No standalone feature-disable workaround is published by Intel, so upgrading to 1.13 is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Intel QuickAssist Technology (QAT) accelerates cryptographic and compression workloads via a dedicated PCIe hardware adapter (here the 8960) driven by host-side software and drivers. The root cause is CWE-822 (Untrusted Pointer Dereference), in which the software dereferences a pointer whose value originates from an untrusted source (e.g., user-controlled input crossing into the adapter software's Ring 3 user-application code) without adequate validation. Per the CPE (cpe:2.3:a:n/a:intel(r)_quickassist_adapter_8960_software:*), the affected component is the adapter software package rather than the silicon itself, and controlled corruption of a dereferenced pointer can steer execution or memory access to escalate privileges.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Authenticated local user with low complexity and no UI (AV:L/AC:L/PR:L/UI:N); untrusted pointer dereference yields full local compromise (C/I/A:H), scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Untrusted pointer dereference for some Intel(R) QuickAssist Adapter 8960 software before version 1.13 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Executive ViewAI
Intel QuickAssist Adapter 8960 versions before 1.13 contain a local privilege escalation vulnerability (CVSS 8.5) that allows standard system users to gain full administrative rights. This directly impacts organizations deploying QuickAssist for cryptographic acceleration-including payment processors, cloud providers, and secure communications infrastructure-by creating a complete system compromise pathway from low-privilege accounts. No patch is currently available, requiring immediate access restrictions to prevent insider exploitation or abuse of compromised standard accounts.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local system access to approved administrative and service accounts only; implement privileged access management (PAM) to control administrative functions; deploy endpoint detection and response (EDR) to detect local privilege escalation patterns; disable QuickAssist on systems where not operationally critical; isolate affected systems from sensitive network segments; establish enhanced audit logging of all local account activities and privilege changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB