High Level Synthesis Compiler
Monthly
DLL planting (uncontrolled search path) in the Intel/Altera High Level Synthesis Compiler i++ command on Windows allows a locally positioned attacker to have an arbitrary DLL loaded by the compiler, which can lead to code execution in the context of the invoking developer. Exploitation requires local write access to a directory that appears in the DLL search order used by i++ (consistent with AV:L/PR:L) plus a user actively running the i++ command (UI:A), and is further constrained by high attack complexity and an attack precondition per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. No confirmed active exploitation and no public exploit code were identified at time of analysis, and the EPSS score is very low at 0.12% (2nd percentile), making this a low-to-moderate real-world priority despite the CVSS 4.0 base score of 5.4.
DLL search-order hijacking in the Altera High Level Synthesis Compiler (versions 19.1 through 24.3) on Windows lets a local attacker who can write to a directory that is searched ahead of the legitimate library location plant a malicious DLL that the compiler loads on startup. Exploitation requires existing low-privileged local access, high attack complexity, and a legitimate user actively launching the compiler, so the practical risk is moderate and low priority; the assigned CVSS 4.0 base score is 5.4 (CVSS 3.1 equivalent AV:L/AC:H/PR:L/UI:R, C:H/I:H/A:H). EPSS is only 0.12% (2nd percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing, indicating limited real-world targeting to date.
Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software before version 23.4 may allow an authenticated user to potentially enable escalation of privilege via local access. Rated medium severity (CVSS 5.4). No vendor patch available.
DLL planting (uncontrolled search path) in the Intel/Altera High Level Synthesis Compiler i++ command on Windows allows a locally positioned attacker to have an arbitrary DLL loaded by the compiler, which can lead to code execution in the context of the invoking developer. Exploitation requires local write access to a directory that appears in the DLL search order used by i++ (consistent with AV:L/PR:L) plus a user actively running the i++ command (UI:A), and is further constrained by high attack complexity and an attack precondition per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. No confirmed active exploitation and no public exploit code were identified at time of analysis, and the EPSS score is very low at 0.12% (2nd percentile), making this a low-to-moderate real-world priority despite the CVSS 4.0 base score of 5.4.
DLL search-order hijacking in the Altera High Level Synthesis Compiler (versions 19.1 through 24.3) on Windows lets a local attacker who can write to a directory that is searched ahead of the legitimate library location plant a malicious DLL that the compiler loads on startup. Exploitation requires existing low-privileged local access, high attack complexity, and a legitimate user actively launching the compiler, so the practical risk is moderate and low priority; the assigned CVSS 4.0 base score is 5.4 (CVSS 3.1 equivalent AV:L/AC:H/PR:L/UI:R, C:H/I:H/A:H). EPSS is only 0.12% (2nd percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing, indicating limited real-world targeting to date.
Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software before version 23.4 may allow an authenticated user to potentially enable escalation of privilege via local access. Rated medium severity (CVSS 5.4). No vendor patch available.