Intel NPU Driver EUVD-2026-56498

Exploitation requires local, authenticated access to the target system with a standard low-privileged user account - no administrator or root access is necessary. The system must be running the Intel NPU Driver on Intel Core Ultra processor hardware with an integrated NPU. No special driver configuration, non-default settings, or insider knowledge of driver internals is required per the description and AT:N metric. No user interaction beyond the attacker's own actions is needed (UI:N). Exploitation is constrained to systems where the Intel NPU Driver is installed and the NPU hardware is present; systems lacking Intel Core Ultra or equivalent NPU-equipped processors, or environments where the driver is not loaded (e.g., servers, older Intel hardware), are not affected. The absence of network exposure (AV:L) means remote unauthenticated exploitation is not possible.

The CVSS 4.0 score of 6.9 (Medium) is consistent with the threat model: local access is required (AV:L), complexity is low (AC:L), no special attack requirements apply (AT:N), and a low-privileged account suffices (PR:L). The impact profile is asymmetric - high availability impact (VA:H) on the vulnerable system, minimal integrity impact (VI:L), no confidentiality exposure (VC:N), and no scope change to subsequent systems (SC:N/SI:N/SA:N). No EPSS data was included in the available intelligence, precluding probabilistic exploitation rate assessment. The vulnerability is absent from the CISA KEV catalog and no proof-of-concept code has been identified, indicating no confirmed active or opportunistic exploitation. Real-world priority is moderate: the local access constraint significantly narrows the attacker population to authenticated local users, insider threats, or already-compromised endpoints; however, the absence of additional mitigating conditions (no non-default configuration required, no user interaction) means any standard user account on an affected system is sufficient. Defenders on systems with Intel Core Ultra hardware and active AI/NPU workloads should treat this as a targeted but realistic insider-threat or post-compromise scenario.

An authenticated local user on an Intel Core Ultra-equipped workstation or laptop opens a low-privileged process and submits a crafted or malformed request to the Intel NPU Driver interface, hitting an edge case that the firmware's conditions check does not properly handle per CWE-754. The driver enters an unrecoverable error state, triggering a high-availability-impact denial of service - most likely a driver crash or system freeze requiring a reboot - with no prior configuration change or user interaction needed. No public exploit code has been identified, but the low attack complexity means the triggering condition does not require specialized reverse engineering of the driver.