Intel Connectivity Performance Suite EUVD-2026-29527

Exploitation requires: (1) a local authenticated account with at minimum low-privilege access to the target system (CVSS PR:L); (2) write access to at least one directory that appears in the installer's DLL or executable search path before the legitimate resource location; (3) the specific attack condition being met - the attacker's malicious file must be pre-positioned in that directory before the installer is invoked (AT:P); and (4) active user interaction in the form of a privileged user voluntarily executing the Intel Connectivity Performance Suite installer (UI:A). Exploitation is bounded to the installer execution window only - the runtime software post-installation is not implicated. The flaw is strictly local (AV:L) with no network-facing attack surface, and there are no subsequent cross-system impacts (SC:N/SI:N/SA:N). The high attack complexity (AC:H) further implies that timing, file naming precision, and path placement must all align correctly for the attack to succeed.

The vendor-assigned CVSS 4.0 score of 5.4 (Medium) is appropriate given the significant exploitation barriers, though the SSVC technical impact of 'total' reflects that successful exploitation yields full C/I/A compromise of the vulnerable system. The risk signals are largely aligned and point to low real-world priority: EPSS at 0.01% (3rd percentile) indicates negligible observed exploitation; SSVC marks exploitation as 'none' and automatable as 'no'; no CISA KEV listing exists; and no public proof-of-concept has been identified. The CVSS 4.0 vector independently corroborates this - AC:H (high complexity), AT:P (specific attack conditions must be present), PR:L (requires an existing authenticated foothold), and UI:A (a privileged user must actively run the installer) together make reliable exploitation difficult to replicate at scale. The primary risk scenario is a shared workstation or build environment where an unprivileged local user can pre-position files before an administrator runs the Intel installer. There is no conflict between the CVSS vector and the description; both consistently indicate local-only, high-complexity, user-interaction-dependent exploitation.

An attacker with a standard user account on a shared Windows workstation identifies a writable directory in the search path used by the Intel Connectivity Performance Suite installer and places a malicious DLL or executable with a name the installer is expected to load. When a privileged administrator subsequently launches the installer - for example, during a scheduled software deployment - the Windows loader resolves the import to the attacker's file rather than the legitimate library, executing arbitrary code in an elevated context. No public proof-of-concept has been identified at time of analysis, but DLL hijacking tooling is broadly available, lowering the skill bar for a motivated local attacker with write access to the relevant path.