Intel R Npu Driver
Monthly
Out-of-bounds read in the Intel Neural Processing Unit (NPU) Driver across all versions exposes systems to local denial of service via a low-privilege authenticated attacker operating in Ring 3 (user application space). The CVSS 4.0 score of 6.9 reflects high availability impact with a local, low-complexity, no-interaction attack path, alongside minor integrity degradation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Denial of service in the Intel NPU Driver firmware (all versions) is achievable by any local authenticated low-privileged user through an improper conditions check (CWE-754) in the Ring 1 device driver layer. The flaw allows an unprivileged software process operating under an authenticated user context to trigger a high-availability-impact disruption - likely a driver crash or system hang - with no attack requirements and no user interaction beyond the attacker's own actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low complexity and minimal privilege bar make it straightforward to exploit on any affected Intel Core Ultra system where the NPU driver is loaded.
Denial of service in Intel(R) NPU Driver affects all versions via an improper conditions check (CWE-754) reachable from Ring 3 (user applications). A locally authenticated, low-privileged user can trigger the flaw without any special attack prerequisites or user interaction, resulting in high availability impact to the vulnerable system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low complexity of exploitation combined with the growing deployment of NPU-equipped Intel platforms warrants prompt patching.
Improper buffer restrictions in the Intel NPU Driver (Ring 3: User Applications) expose all driver versions to a denial-of-service condition triggerable by a local, low-privileged authenticated user. The CVSS 4.0 vector confirms local-only access (AV:L/PR:L) with high availability impact (VA:H) and a minor integrity side-effect (VI:L), but no confidentiality loss. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, which tempers real-world urgency despite the potentially system-disrupting availability impact.
Out-of-bounds read in the Intel Neural Processing Unit (NPU) Driver across all versions exposes systems to local denial of service via a low-privilege authenticated attacker operating in Ring 3 (user application space). The CVSS 4.0 score of 6.9 reflects high availability impact with a local, low-complexity, no-interaction attack path, alongside minor integrity degradation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Denial of service in the Intel NPU Driver firmware (all versions) is achievable by any local authenticated low-privileged user through an improper conditions check (CWE-754) in the Ring 1 device driver layer. The flaw allows an unprivileged software process operating under an authenticated user context to trigger a high-availability-impact disruption - likely a driver crash or system hang - with no attack requirements and no user interaction beyond the attacker's own actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low complexity and minimal privilege bar make it straightforward to exploit on any affected Intel Core Ultra system where the NPU driver is loaded.
Denial of service in Intel(R) NPU Driver affects all versions via an improper conditions check (CWE-754) reachable from Ring 3 (user applications). A locally authenticated, low-privileged user can trigger the flaw without any special attack prerequisites or user interaction, resulting in high availability impact to the vulnerable system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low complexity of exploitation combined with the growing deployment of NPU-equipped Intel platforms warrants prompt patching.
Improper buffer restrictions in the Intel NPU Driver (Ring 3: User Applications) expose all driver versions to a denial-of-service condition triggerable by a local, low-privileged authenticated user. The CVSS 4.0 vector confirms local-only access (AV:L/PR:L) with high availability impact (VA:H) and a minor integrity side-effect (VI:L), but no confidentiality loss. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, which tempers real-world urgency despite the potentially system-disrupting availability impact.