EUVD-2026-56522
GHSA-x695-2c4c-37q2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low-privilege requirement matches description; availability-only high impact consistent with DoS; no scope change, no confidentiality or integrity impact.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
1DescriptionCVE.org
Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Applications may allow a denial of service. Authorized adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
AnalysisAI
Improper input validation in the vLLM Hardware Plugin for Intel Gaudi software (versions before 0.16.0) allows a locally authenticated user to cause a denial of service, crashing or degrading availability of the affected system. The vulnerability operates within Ring 3 (user application space) and requires only low-privilege local access with no user interaction, making it viable for insider threat or compromised-account scenarios. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis; Intel has released a fix in version 0.16.0.
Technical ContextAI
The affected component is the vLLM Hardware Plugin for Intel Gaudi, an AI accelerator hardware interface plugin that enables vLLM - an open-source large language model serving framework - to offload inference workloads to Intel Gaudi (HPU) hardware accelerators. The flaw is classified under CWE-20 (Improper Input Validation), meaning the plugin fails to adequately sanitize or bound-check inputs received from user-space applications operating in Ring 3 (the least-privileged CPU protection ring). Exploitation in Ring 3 implies no kernel-level privilege escalation is involved; the impact is constrained to the availability of the plugin or the inference service it supports. The CPE string (cpe:2.3:a:n/a:vllm_hardware_plugin_for_intel(r)_gaudi(r)_software) indicates this is a standalone software component, and the 'n/a' vendor field in NVD reflects that no distinct vendor entity was mapped outside of Intel.
RemediationAI
Upgrade the vLLM Hardware Plugin for Intel(R) Gaudi(R) software to version 0.16.0 or later, as confirmed by Intel's security advisory INTEL-SA-01487 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01487.html). If immediate patching is not possible, restrict local system access to only trusted, authorized users and enforce the principle of least privilege on accounts that interact with the Gaudi plugin. Additionally, consider isolating the inference workload environment from general-purpose multi-user access to reduce the attack surface. These compensating controls narrow the pool of potential authenticated local attackers but do not eliminate the underlying input validation flaw.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today