Intel
Monthly
Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk.
Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening.
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.
Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.
Symlink-based file clobbering in the Linux kernel's intel-speed-select daemon allows a local low-privileged user to redirect root-process writes to an attacker-chosen file by pre-positioning a symlink at the daemon's fixed /tmp pidfile path. Affected systems are those running Linux 5.18 through unpatched 6.x and 7.x branches on Intel Speed Select Technology hardware with the daemon active. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile), but the attack is mechanically simple and requires only a local shell account.
Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation.
Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. Patch is confirmed available per Amazon's security bulletin AWS-2026-079; no public exploit code has been identified at time of analysis.
Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.
Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Alias Checking Trusted Module (ACTM) firmware for certain Intel Xeon processors allows a local privileged attacker to escalate to System Management Mode (SMM) execution, achieving high confidentiality and integrity impact across both the directly compromised system and subsequent systems such as co-hosted hypervisors or tenant workloads. The attack requires high-complexity local technique combined with pre-existing privileged user access, placing it firmly in the advanced persistent threat actor category. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01439 to address this firmware flaw.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows local unprivileged code operating within the Ring 2 privileged process boundary to elevate access rights due to improper privilege management (CWE-269), yielding high availability impact and limited confidentiality and integrity exposure on both the vulnerable and subsequent systems. The attack is constrained to local access and requires high complexity, but no prior authentication or user interaction is needed from the attacker. Intel has published advisory INTEL-SA-01468 to address this flaw; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Improper authentication (CWE-287) in Intel's Trust Domain Extensions (TDX) module allows a Ring-0 system software adversary with high privileges to breach Trust Domain isolation boundaries, enabling information disclosure and privilege escalation. Affects select Intel platforms running TDX with a high-complexity, locally-executed attack path - no user interaction required. No public exploit identified at time of analysis, but the confidential-computing trust model is fundamentally undermined if exploited: an adversary with hypervisor-level access could read or modify memory intended to be protected from exactly that privilege tier.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from a null pointer dereference (CWE-476) in the Ring 2 device driver layer, allowing an adjacent unauthenticated attacker to crash the affected system with no user interaction required. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms low-complexity exploitation from the same network segment, resulting in high availability impact to the vulnerable system and residual low availability impact to subsequent systems. No public exploit code or CISA KEV entry has been identified at time of analysis, though the absence of authentication and interaction requirements makes this trivially triggerable by any adjacent network adversary.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from improper buffer restrictions (CWE-119) in the Ring 2 device driver layer, exploitable by an adjacent network attacker without authentication or user interaction. An attacker within Wi-Fi range or on the same network segment can trigger a driver-level crash by sending crafted wireless input, resulting in high availability impact on the target system and low availability impact on subsequent systems, with no confidentiality or integrity consequences. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established.
Null pointer dereference in Intel PROSet/Wireless WiFi Software for Windows at the Ring 2 device driver layer enables denial of service by an unauthenticated adjacent-network attacker. Disclosed by Intel in advisory INTEL-SA-01422, the flaw affects all currently indexed versions of the software and can be triggered at low complexity with no user interaction or special attack prerequisites. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the kernel-mode (Ring 0) component of Intel PROSet/Wireless WiFi Software for Windows enables a denial-of-service condition against affected Windows hosts. An unauthenticated attacker with adjacent network access and the ability to satisfy specific attack requirements can trigger a kernel-level crash, resulting in high availability impact to both the vulnerable system and any subsequent system processes. No public exploit code has been identified at time of analysis, and this CVE has not been listed in the CISA Known Exploited Vulnerabilities catalog.
Denial of service in Intel PROSet/Wireless WiFi Software affects the Ring 2 device driver layer, where an improper conditions check (CWE-754) can be triggered by an adjacent, unauthenticated attacker with no user interaction required. The vulnerability collapses wireless availability on the affected host and, per the CVSS 4.0 vector, cascades to subsequent system availability as well, meaning dependent network-connected services may also be disrupted. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in Intel PROSet/Wireless WiFi Software at the Ring 2 device driver layer allows adjacent network attackers without authentication to escalate privileges on affected Windows systems. The flaw, tracked under CWE-125, can be triggered by a low-complexity attack from the same WiFi segment or Layer 2 broadcast domain, requiring no user interaction, and yields High availability impact alongside Low confidentiality and integrity exposure. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated adjacent attack surface is meaningful for enterprise mobile workforces on untrusted networks.
Denial of service in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows an unauthenticated adjacent-network attacker to crash or disable the wireless subsystem on affected systems. The flaw stems from an improper conditions check (CWE-754) within the WiFi driver stack, meaning edge-case or malformed network input is not handled safely, leading to complete availability loss of the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, zero-privilege attack vector makes this straightforward to trigger from WiFi range.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.
Improper access control in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows a local unprivileged process to cause a denial of service affecting both the wireless subsystem and, to a lesser extent, downstream system integrity. Affected systems running Intel wireless drivers are exposed to any unprivileged local code - no authentication, no elevated privileges, and no user interaction are required. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Denial-of-service in Intel PROSet/Wireless WiFi Software for Windows (Ring 2 device driver layer) allows an unauthenticated adjacent-network attacker to crash or disable the wireless driver with no user interaction. The flaw stems from an improper conditions check (CWE-754) in the driver, yielding complete loss of wireless availability on the affected system and minor downstream availability impact on subsequently connected systems. No public exploit or CISA KEV listing exists at time of analysis, and Intel has published an advisory at INTEL-SA-01422.
Intel PROSet/Wireless WiFi Software for Windows contains a null pointer dereference in Ring 0 (kernel space) that an adjacent, unauthenticated attacker can exploit to crash the target system, resulting in a denial of service. The flaw resides in the WiFi kernel driver, meaning a successful trigger causes a kernel panic (BSOD on Windows) with high availability impact on both the vulnerable component and the broader system. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the adjacent-network attack vector and zero-privilege requirement make this relevant for any environment where untrusted parties share a wireless segment with Intel WiFi-equipped Windows endpoints.
Improper access control within Ring 3 (user application space) of Intel processors permits privilege escalation from authenticated local user-level access to higher system privilege levels, with high confidentiality and integrity impact on the vulnerable system. Exploitation demands local access, low-privilege authentication, high attack complexity, and specialized internal knowledge of Intel processor microarchitecture internals - substantially narrowing the realistic attacker population. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, consistent with a threat relevant primarily to sophisticated, targeted adversaries.
Denial of service via improper input validation in Intel Active Management Technology (AMT) and Intel Standard Manageability firmware allows unauthenticated network-adjacent attackers to disrupt the out-of-band management interface. The CVSS 4.0 AT:P designation confirms that specific prerequisites - namely AMT being provisioned and network-accessible - must independently exist before exploitation is possible. No public exploit has been identified at time of analysis, and Intel has disclosed the issue under advisory INTEL-SA-01427.
Protection mechanism failure in Intel Data Center Attestation Primitives (Intel DCAP) enables unauthenticated network-based attackers with specialized internal knowledge to undermine the integrity of the attestation system and expose confidential data from downstream systems relying on SGX enclave verification. The vulnerability (CWE-693) is particularly impactful in confidential computing environments where DCAP serves as the trust anchor for SGX workload isolation. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01449 addressing this issue.
Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.
Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the `data->streams[]` array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.
Out-of-bounds bitmap write in the Linux kernel's Intel ICE SR-IOV driver allows a malicious Virtual Function guest to crash the host kernel or potentially escalate privileges to the host. The vulnerable function ice_parser_profile_init unconditionally passes caller-controlled ptype values from VIRTCHNL_OP_ADD_RSS_CFG into set_bit() against a statically sized 1024-bit bitmap, permitting a value such as 0xffff to write beyond the bitmap boundary and trigger a kernel NULL pointer dereference. No public exploit code has been identified and EPSS exploitation probability is low at 0.18%, but the CVSS 8.8 score and confirmed crash reproducibility signal real urgency for SR-IOV multi-tenant environments where stable-branch patches are already available.
Unbounded retry loops in BC-FJA's JNI native entropy layer cause calling threads to hang indefinitely when Intel RDSEED or RDRAND instructions persistently fail, producing a non-interruptible thread-level denial of service in any Java FIPS application backed by bc-fips 2.1.x before 2.1.3. The affected JNI seeding routine re-issues the CPU entropy instruction without any iteration limit whenever the carry flag signals failure - a condition reproducible by hardware entropy source faults, DRBG exhaustion under heavy multi-core contention, or hypervisors that do not forward these Intel instructions to guest VMs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the conditions are routinely present in virtualized environments where hypervisors commonly withhold RDRAND/RDSEED forwarding, making this a realistic operational risk for enterprise Java FIPS deployments in cloud or VM-based infrastructure.
Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.
Denial of service in the Linux kernel's Intel iwlwifi 'mld' Wi-Fi driver allows a firmware crash on Intel BE201/Wi-Fi 7 adapters to spiral into sustained resource exhaustion. Because iwl_mld_tx_from_txq() failed to check the in_hw_restart flag, TX frames kept being dequeued and pushed to dead firmware, each returning -EIO and being freed in a tight loop that burns CPU and churns skb allocations, causing slab fragmentation and memory pressure. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and the issue is not on CISA KEV; it is a reliability/availability bug that manifests under real load, not an attacker-driven remote exploit.
Local privilege-impacting memory corruption in the Linux kernel's Intel ice network driver allows a double-free of a transmit buffer's skb when the TX offload paths fail. When ice_tso() or ice_tx_csum() return an error, ice_xmit_frame_ring() frees the skb but leaves the 'first' tx_buf still marked ICE_TX_BUF_SKB, so a later ice_clean_tx_ring() during interface teardown frees the same skb a second time. Carries a CVSS 3.1 base of 7.8 (AV:L/PR:L), but with a low EPSS of 0.15% (5th percentile), no KEV listing, and no public exploit identified at time of analysis.
Race condition in the Linux kernel's Intel VT-d IOMMU driver allows a local low-privileged attacker to trigger inconsistent PASID table state during domain replacement, potentially producing spurious IOMMU faults and unpredictable DMA behavior with cross-scope impact. The flaw stems from non-atomic updates to 512-bit PASID entries while the Present bit is set, and no public exploit identified at time of analysis despite a high CVSS score driven by the scope-changed local attack surface.
Kernel memory corruption in the Linux iWARP Connection Manager (RDMA/iwcm) subsystem can crash systems running RDMA workloads on iWARP-capable hardware such as Intel E830 adapters. The bug, introduced by commit e1168f0 ('RDMA/iwcm: Simplify cm_event_handler()'), causes workqueue list corruption when iwcm_work items from a free list are reused while still queued, triggering a kernel BUG and panic. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 5th percentile), despite a CVSS base score of 9.8.
Out-of-bounds array access in the Linux kernel's Intel Discrete Graphics MTD driver (mtd_intel_dg.c) lets a local actor trigger kernel memory corruption when the driver enumerates NVM regions before nregions is initialized. The flaw, caught by UBSAN as an array-index-out-of-bounds at line 750, affects systems running kernel 6.17 through the pre-patch 6.18/6.19 series with Intel discrete graphics hardware. No public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.02%, 4th percentile).
Race condition in Linux kernel Intel VT-d IOMMU driver (iommu/vt-d) allows torn reads of Scalable Mode PASID table entries during teardown, producing unpredictable behavior or spurious faults on systems with Intel VT-d enabled. The flaw stems from zeroing the entire 64-byte PASID entry while the Present bit is still set, violating the VT-d spec's invalidation guidance. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but a vendor patch is available across multiple stable branches.
Denial of service in the Linux kernel's EFI unaccepted-memory handling allows a boot-time kernel panic on confidential-computing guests, affecting kernels from 6.6 through the 6.19/7.0 development line. The reserve_unaccepted() routine miscalculates the memblock reservation size when the unaccepted memory table is not page-aligned, leaving the table's tail unreserved so it can be overwritten or rendered inaccessible, triggering a panic in accept_memory(). It is observed on Intel TDX VMs with larger memory sizes (e.g. >64GB); there is no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are configured without hardware crypto acceleration, allowing remote unauthenticated attackers to cause denial of service via undisclosed traffic patterns. CVSS 7.5 (High) with network attack vector and no prerequisites. EPSS data not provided, no CISA KEV listing identified, indicating theoretical rather than observed exploitation. Vendor patch available per F5 advisory K000158082.
Local privilege escalation in Intel QuickAssist Technology (QAT) software drivers for Windows before version 1.13 lets an authenticated low-privileged user elevate to higher privileges through improper input validation in a Ring 3 user-application code path. The flaw was reported by Intel PSIRT (INTEL-SA-01387) and carries a CVSS 4.0 base of 8.5, but there is no public exploit identified at time of analysis and EPSS is a low 0.03% (8th percentile). SSVC scores exploitation as none and not automatable, consistent with a driver bug that requires prior local, authenticated access.
Local privilege escalation in Intel QuickAssist Technology (QAT) software drivers for Windows before version 1.13 lets an authenticated, unprivileged local user escalate to higher privileges via an out-of-bounds write (CWE-787) in Ring 3 user-application code. The flaw carries a CVSS 4.0 base score of 8.5 with total technical impact but is not known to be exploited - CISA's SSVC framework rates exploitation as 'none' and EPSS is negligible at 0.01% (3rd percentile), with no public exploit identified at time of analysis.
Improper access control in all versions of Intel Vision software allows a remote, unauthenticated attacker to trigger denial of service and, under low-complexity conditions, achieve remote code execution against the Ring 3 user-application layer. The CVSS 4.0 base score of 8.8 reflects high confidentiality impact with lesser integrity and availability effects; there is no public exploit identified at time of analysis, and EPSS is low at 0.20% (42nd percentile). Intel published advisory SA-01457 and CISA's SSVC framework rates exploitation as none but technical impact as total.
Local privilege-driven data corruption in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 allows a privileged local adversary to trigger an out-of-bounds write (CWE-787) in a Ring 1 device driver, causing denial of service and integrity loss. The flaw affects the vulnerable system's integrity and availability (both High) with no confidentiality impact, and carries a CVSS 4.0 base score of 8.3. There is no public exploit identified at time of analysis, and the EPSS probability is negligible at 0.01%.
Local privilege escalation in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger a Ring 1 device-driver buffer overflow to execute arbitrary code and take total control of the host. The flaw carries a CVSS 4.0 base score of 9.3 with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis, and the EPSS score is negligible at 0.01% (3rd percentile), consistent with the SSVC verdict of no known exploitation.
Local privilege-abusing denial of service and information disclosure in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger an out-of-bounds read (CWE-125) in the Ring 1 device-driver layer, potentially crashing the host and exposing adjacent memory. The flaw carries a CVSS 4.0 base score of 8.3 driven by high confidentiality and availability impact plus a scope change into subsequent systems. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC rates exploitation as 'none' and non-automatable.
Local privilege escalation in Intel QuickAssist Adapter 8960 software before version 1.13 allows an authenticated, low-privileged user to abuse an untrusted pointer dereference in a Ring 3 user-application component to gain elevated privileges on the host. The flaw yields total impact (high confidentiality, integrity, and availability) on the affected system and carries a CVSS 4.0 base score of 8.5. There is no public exploit identified at time of analysis, and EPSS rates near-term exploitation probability at just 0.01%.
Integer overflow in Linux kernel's i915 graphics driver corrupts memory mapping for DRM/GEM shmem objects larger than 4GB, causing kernel warnings, potential crashes, and incorrect memory access when Intel graphics hardware processes large buffer objects. The vulnerability manifests when scatterlist length fields overflow during folio page allocation, leading to premature termination of backing page iteration. Patch available across multiple stable kernel branches (6.6.130, 6.12.78, 6.18.19, 6.19.9, 7.0) per upstream commits. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
Stack buffer overflow in Sandboxie-Plus SbieSvc proxy service enables SYSTEM privilege escalation from sandboxed processes, including Security Hardened Sandboxes. Attackers chain an information disclosure (returning up to 32KB uninitialized stack memory with ASLR/stack cookie bypass) with an unbounded memcpy overflow in the GetRawInputDeviceInfoSlave IPC handler. Intel CET shadow stacks block ROP exploitation but not the information leak itself. Vendor-released patch available in version 1.17.3. No public exploit identified at time of analysis, but attack complexity is rated high (AC:H) with low privilege requirements (PR:L), making this viable for motivated attackers targeting sandbox environments.
Use-after-free in Linux kernel Bluetooth Intel driver enables local privilege escalation to kernel code execution. Affects Linux kernel 4.3 through 7.0-rc5, with patches available in versions 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0. Exploitation requires local authenticated access with low privileges (CVSS PR:L). EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No public exploit code or active exploitation confirmed at time of analysis, though technical details in CVE description provide implementation roadmap.
Attested TLS relay attacks in Cocos AI confidential computing system versions 0.4.0 through 0.8.2 enable attackers to impersonate genuine TEE-protected services on AMD SEV-SNP and Intel TDX platforms by extracting ephemeral TLS private keys and redirecting authenticated sessions. The architectural flaw allows an attacker with physical access or side-channel capabilities to relay attestation evidence to a different endpoint, breaking the authentication binding between the TEE and the client. No vendor-released patch is available; the vulnerability affects a specialized confidential computing platform with low EPSS probability (formal EPSS score not provided in input) and no public exploit identified at time of analysis, though formal ProVerif verification confirms the attack feasibility.
This vulnerability in Intel EPT (Extended Page Tables) paging code within Xen allows information disclosure through a use-after-free condition in cached EPT state management. When paging structures are freed before cached EPT state is flushed, stale entries can persist in the EPT cache pointing to memory ranges outside the guest's intended ownership, enabling unauthorized memory access. Xen across multiple versions is affected, with Ubuntu tracking the issue at medium priority across 7 releases and Debian across 7 releases, making this a widespread concern for virtualization infrastructure.
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously crafted web content, with Apple confirming active exploitation on Intel-based Mac systems. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS 8.8 score requiring only user interaction (visiting a malicious page) to achieve remote code execution. EPSS at 1.55% (81st percentile) is moderate but the KEV listing signals real-world targeted abuse against Apple's WebKit-based browsing stack.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote code execution through crafted log messages, affecting virtually every Java application on Earth and triggering the largest vulnerability remediation effort in history.
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Local privilege escalation to SYSTEM in Intel Ethernet diagnostics driver (IQVW32.sys/IQVW64.sys versions before 1.3.1.0) allows authenticated Windows users to execute arbitrary code with kernel privileges via crafted IOCTL calls to device driver interfaces. CISA confirms active exploitation in the wild (KEV-listed). Multiple public proof-of-concept exploits demonstrate exploitability across four IOCTL handlers (0x80862013, 0x8086200B, 0x8086200F, 0x80862007). With 4.99% EPSS probability (90th percentile) and confirmed real-world abuse, this represents a critical risk for systems with Intel network adapters where the diagnostic driver remains installed and unpatched.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.6%.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%.
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() In iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses the out_free_eeprom_blob label. Consequently, error paths triggered after successfully parsing the EEPROM free priv->nvm_data but leak priv->eeprom_blob. Fix this memory leak by reordering the error handling labels so that out_free_eeprom falls through to out_free_eeprom_blob. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc6. An x86_64 allyesconfig build showed no new warnings. As we do not have supported Intel DVM wireless hardware and firmware to test with, no runtime testing was able to be performed.
In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() The q->replay_state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup_user(). Return an error if q->replay_state is not empty. Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit f6b6cc1118bdbc4265fa8b3bdf8565b26f13e56e)
In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in mem_write() In mem_write(), the temporary array returned by parse_int_array_user() must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so it is freed automatically on return. This also moves the array declaration next to parse_int_array_user() as required by cleanup.h usage guidelines.
Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.
Transient execution information disclosure in Intel processors allows a Ring 0 (kernel or hypervisor level) adversary to leak sensitive data across security boundaries into a subsequent system context. The flaw stems from incorrect data forwarding during speculative execution, a class of hardware-level side-channel vulnerability similar to Spectre-class attacks, requiring local access with high privileges and high attack complexity. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation enables high-confidentiality-impact cross-boundary data exposure, threatening hypervisor isolation guarantees critical in virtualized and cloud environments.
Firmware improper input validation in Intel Xeon processors enables a highly privileged local adversary operating within System Management Mode (SMM) or startup code context to alter the integrity of subsequent system components. The CVSS 4.0 vector confirms local-only access (AV:L), high complexity (AC:H), presence-required attack conditions (AT:P), and a high-privilege prerequisite (PR:H), with zero confidentiality or availability impact - only downstream integrity degradation (SI:H). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world exploitation risk firmly in the advanced persistent threat category rather than opportunistic attack.
Incomplete cleanup (CWE-459) in UEFI firmware for select Intel reference platforms allows a high-privileged local system software adversary to read sensitive residual data that was not properly purged from firmware memory or registers, resulting in high confidentiality impact on the subsequent system layer. The vulnerability requires specific attack conditions (AT:P) and is scoped to Intel reference platforms identified in advisory INTEL-SA-01437. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Privilege escalation in Intel(R) Transfer Learning Tool before version v0.7 stems from a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling unauthenticated remote attackers to elevate privileges under specific attack conditions. The flaw affects confidentiality, integrity, and availability at a low severity each, with no subsequent system-level impact confirmed. No public exploit code or CISA KEV listing exists at time of analysis, and Intel has published advisory INTEL-SA-01499 addressing this issue.
Intel Software Guard Extensions Data Center Attestation Primitives (SGX DCAP), operating at Ring 0 kernel privilege level, omits security-relevant information during attestation operations, enabling a privileged local attacker under high-complexity conditions to cause denial of service and high-integrity data alteration on downstream systems relying on attestation output. The SI:H subsequent-system integrity impact is the critical concern: systems that consume SGX attestation results - cloud orchestrators, confidential VM managers, or trust brokers - may accept manipulated evidence, undermining the core trust guarantees of confidential computing infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H and AC:H prerequisites substantially constrain the realistic attacker pool.
Privilege escalation in Intel Processors operating within Ring 0 environments - kernel, hypervisor, and bare-metal OS - allows an authorized attacker already holding high-privilege access to cross isolation boundaries and achieve high confidentiality and integrity impact on subsequent systems such as hypervisors or co-located virtual machines. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/SC:H/SI:H) confirms the attack is local, high-complexity, and gated behind existing privileged access plus special internal knowledge of processor internals, significantly limiting the exploitable population. No public exploit code and no CISA KEV listing exist at time of analysis, making current real-world risk primarily theoretical but relevant to hardened multi-tenant and virtualized datacenter environments.
Deserialization of untrusted data in Intel Extension for PyTorch (IPEX) versions before 2.8.0 enables local privilege escalation when a victim user opens a maliciously crafted serialized artifact within an IPEX-dependent application. The vulnerability operates at Ring 3 (user-space) and yields low confidentiality, integrity, and availability impact with no subsequent system-level compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Intel Performance Counter Monitor (PCM) before version tag 202604 allows a local authenticated attacker to gain elevated privileges via an untrusted search path (CWE-426) within Ring 3 user-space applications. The attack requires high complexity and passive interaction from a privileged user, producing full high-impact confidentiality, integrity, and availability compromise of the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Insufficient access control granularity in a subsystem of Intel Xeon 6 Scalable processors with Trust Domain Extensions (TDX) enables cross-domain information disclosure. The flaw, classified under CWE-1220, allows an authenticated local adversary with specialized knowledge of processor internals to leak confidential data belonging to a co-resident trust domain or protected virtual machine, while leaving integrity and availability of all systems untouched. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 4.0 scope-change pattern (VC:N/SC:H) signals a meaningful cross-trust-domain confidentiality risk specifically in confidential computing deployments.
Privilege escalation in Intel Xeon 6 processors arises from improper handling of overlapping protected memory ranges when Intel Trust Domain Extensions (TDX) operate within System Management Mode (SMM). An adversary who has already achieved SMM-level access and combines that foothold with a high-complexity, knowledge-intensive attack can break the isolation guarantees that TDX is designed to enforce, achieving unauthorized reads and writes of confidential memory. No public exploit code and no CISA KEV listing are associated with this issue at time of analysis, but the high confidentiality and integrity impact to the vulnerable system makes it significant for confidential-computing deployments.
Insufficient data authenticity verification within Intel Trust Domain Extensions (Intel TDX) at Ring 0 (hypervisor privilege level) enables information disclosure under a high-complexity, locally-mounted attack. A system software adversary already holding hypervisor-level privileges can exploit CWE-345 conditions to expose sensitive Trust Domain memory contents, achieving high confidentiality impact on the vulnerable system with limited integrity effects on both the vulnerable and subsequent systems. No public exploit code exists and this vulnerability has not been listed in CISA KEV, with the vendor-confirmed CVSS 4.0 score of 5.6 (Medium) accurately reflecting the constrained attack profile.
Privilege escalation in Intel Workload Services Framework software affects the Ring 3 user-application layer, where a protection mechanism failure (CWE-693) allows an unprivileged process to gain elevated privileges when a concurrently active privileged user provides passive interaction. The attack is local, requires attack prerequisites to be met (AT:P per CVSS 4.0), and achieves full compromise of the vulnerable system's confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis; this is a vendor-disclosed advisory via INTEL-SA-01467.
Integer overflow in Intel Slim Bootloader UEFI firmware exposes systems to limited information disclosure and denial of service. Exploitation requires local, authenticated access with active user interaction, yielding only low-impact confidentiality and availability consequences with no integrity impact. No active exploitation has been identified; the CVSS 4.0 score of 2.4 reflects the constrained exploitation conditions and limited blast radius.
Improper input validation in the vLLM Hardware Plugin for Intel Gaudi software (versions before 0.16.0) allows a locally authenticated user to cause a denial of service, crashing or degrading availability of the affected system. The vulnerability operates within Ring 3 (user application space) and requires only low-privilege local access with no user interaction, making it viable for insider threat or compromised-account scenarios. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis; Intel has released a fix in version 0.16.0.
Out-of-bounds write (CWE-787) in Intel Slim Bootloader firmware enables a denial of service condition on the local system. Exploitation requires a privileged local account and the presence of specific attack preconditions (AT:P per CVSS 4.0), and impact is confined to low availability on the vulnerable system with no confidentiality or integrity consequences. Intel disclosed this issue through advisory INTEL-SA-01475 with a CVSS 4.0 base score of 1.8; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Privilege escalation in Intel(R) oneCCL Bindings for PyTorch before v2.8.0 stems from a protection mechanism failure (CWE-693) in Ring 3 user application space, enabling a local adversary - operating in conjunction with a high-privilege user through passive interaction - to escalate privileges with full confidentiality, integrity, and availability impact on the vulnerable system. The CVSS 4.0 score of 5.4 reflects meaningful exploitation constraints: specific attack requirements must be present (AT:P), high privileges are already required (PR:H), and passive interaction from a privileged user is needed (UI:P). No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis.
Use-after-free in the kernel-mode (Ring 0) driver component of Intel PROSet/Wireless WiFi Software for Windows enables a local denial-of-service condition by crashing the affected system. The flaw resides in the most privileged execution ring on x86/x64, meaning a successful trigger causes a kernel panic (BSOD) with no containment boundary below the OS. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified at time of analysis, and the combination of local-only access with high attack complexity substantially constrains real-world risk.
Privilege escalation in Intel AI Reference Models before v3.4.1 stems from a protection mechanism failure (CWE-693) within Ring 3 user-space applications, allowing unprivileged software to gain elevated access when a privileged user is passively present under specific deployment conditions. The vulnerability carries full confidentiality, integrity, and availability impact on the vulnerable system, though scope is contained with no subsequent-system impact. No public exploit has been identified at time of analysis; Intel has issued a fix in version v3.4.1 per advisory INTEL-SA-01432.
Heap-based buffer overflow in Intel Open Volume Kernel Library (Open VKL) before version 2.0.2 allows a local authenticated attacker with low privileges to cause denial of service against applications consuming the library. Operating entirely in Ring 3 (user space), the flaw requires no user interaction and carries low attack complexity, making it straightforward to trigger for any local account on an affected system. No public exploit code and no active exploitation have been identified; Intel has released version 2.0.2 as the corrective fix per advisory INTEL-SA-01459.
Privilege escalation affects Intel's LLM Library for PyTorch operating within Ring 3 (user application space) due to a protection mechanism failure (CWE-693). An adversary with access to an unprivileged software context, combined with the presence of a privileged user and passive user interaction, can exploit this flaw locally to gain elevated privileges with high impact on confidentiality, integrity, and availability. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.4 reflects the restrictive local access and high-privilege prerequisites that limit real-world exploitability.
Privilege escalation in Intel Neural Compressor software before v3.7 stems from improper input validation within Ring 3 (user application space), allowing a locally authenticated low-privileged user to elevate privileges on the affected host. The CVSS 4.0 vector confirms local access with low complexity, no special attack requirements, and no user interaction needed - meaning exploitation is straightforward once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to the vulnerable system with no lateral scope change.
Denial of service via a TOCTOU race condition in the Intel NPU Driver for Windows affects all current versions operating at Ring 1 (device driver layer). An authenticated local attacker with low privileges can exploit a window between the driver's resource state check and its use, resulting in high availability impact and low integrity impact to the vulnerable system. No active exploitation has been confirmed, and the high attack complexity plus specific attack prerequisites substantially limit opportunistic exploitation.
Privilege escalation in Intel Neural Compressor software before v3.6 stems from a protection mechanism failure (CWE-693) within the Ring 3 user-application layer. A local attacker operating with high privileges, in conjunction with specific attack requirements and passive user interaction, can exploit this flaw to elevate privileges with high confidentiality, integrity, and availability impact on the vulnerable system. Intel has issued advisory INTEL-SA-01454 and released v3.6 as the remediated version; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Intel AI Containers before v0.4.0 exposes a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling a local attacker already holding high privileges to further escalate privileges with full confidentiality, integrity, and availability impact on the vulnerable system. Exploitation requires passive user interaction and specific attack conditions (AT:P), substantially limiting the realistic attack population to multi-tenant AI container deployments where privileged users must be constrained. No public exploit code has been identified and this vulnerability does not appear in CISA KEV at time of analysis.
Local privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows unprivileged local code execution by exploiting improper authentication within the device driver layer. An attacker with only local access and no required privileges can bypass authentication checks in the Ring-2 driver tier, ultimately achieving code execution that results in high confidentiality impact on the broader host system alongside low integrity and availability impacts. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk.
Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening.
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.
Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.
Symlink-based file clobbering in the Linux kernel's intel-speed-select daemon allows a local low-privileged user to redirect root-process writes to an attacker-chosen file by pre-positioning a symlink at the daemon's fixed /tmp pidfile path. Affected systems are those running Linux 5.18 through unpatched 6.x and 7.x branches on Intel Speed Select Technology hardware with the daemon active. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile), but the attack is mechanically simple and requires only a local shell account.
Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation.
Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. Patch is confirmed available per Amazon's security bulletin AWS-2026-079; no public exploit code has been identified at time of analysis.
Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.
Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Alias Checking Trusted Module (ACTM) firmware for certain Intel Xeon processors allows a local privileged attacker to escalate to System Management Mode (SMM) execution, achieving high confidentiality and integrity impact across both the directly compromised system and subsequent systems such as co-hosted hypervisors or tenant workloads. The attack requires high-complexity local technique combined with pre-existing privileged user access, placing it firmly in the advanced persistent threat actor category. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01439 to address this firmware flaw.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows local unprivileged code operating within the Ring 2 privileged process boundary to elevate access rights due to improper privilege management (CWE-269), yielding high availability impact and limited confidentiality and integrity exposure on both the vulnerable and subsequent systems. The attack is constrained to local access and requires high complexity, but no prior authentication or user interaction is needed from the attacker. Intel has published advisory INTEL-SA-01468 to address this flaw; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Improper authentication (CWE-287) in Intel's Trust Domain Extensions (TDX) module allows a Ring-0 system software adversary with high privileges to breach Trust Domain isolation boundaries, enabling information disclosure and privilege escalation. Affects select Intel platforms running TDX with a high-complexity, locally-executed attack path - no user interaction required. No public exploit identified at time of analysis, but the confidential-computing trust model is fundamentally undermined if exploited: an adversary with hypervisor-level access could read or modify memory intended to be protected from exactly that privilege tier.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from a null pointer dereference (CWE-476) in the Ring 2 device driver layer, allowing an adjacent unauthenticated attacker to crash the affected system with no user interaction required. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms low-complexity exploitation from the same network segment, resulting in high availability impact to the vulnerable system and residual low availability impact to subsequent systems. No public exploit code or CISA KEV entry has been identified at time of analysis, though the absence of authentication and interaction requirements makes this trivially triggerable by any adjacent network adversary.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from improper buffer restrictions (CWE-119) in the Ring 2 device driver layer, exploitable by an adjacent network attacker without authentication or user interaction. An attacker within Wi-Fi range or on the same network segment can trigger a driver-level crash by sending crafted wireless input, resulting in high availability impact on the target system and low availability impact on subsequent systems, with no confidentiality or integrity consequences. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established.
Null pointer dereference in Intel PROSet/Wireless WiFi Software for Windows at the Ring 2 device driver layer enables denial of service by an unauthenticated adjacent-network attacker. Disclosed by Intel in advisory INTEL-SA-01422, the flaw affects all currently indexed versions of the software and can be triggered at low complexity with no user interaction or special attack prerequisites. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the kernel-mode (Ring 0) component of Intel PROSet/Wireless WiFi Software for Windows enables a denial-of-service condition against affected Windows hosts. An unauthenticated attacker with adjacent network access and the ability to satisfy specific attack requirements can trigger a kernel-level crash, resulting in high availability impact to both the vulnerable system and any subsequent system processes. No public exploit code has been identified at time of analysis, and this CVE has not been listed in the CISA Known Exploited Vulnerabilities catalog.
Denial of service in Intel PROSet/Wireless WiFi Software affects the Ring 2 device driver layer, where an improper conditions check (CWE-754) can be triggered by an adjacent, unauthenticated attacker with no user interaction required. The vulnerability collapses wireless availability on the affected host and, per the CVSS 4.0 vector, cascades to subsequent system availability as well, meaning dependent network-connected services may also be disrupted. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in Intel PROSet/Wireless WiFi Software at the Ring 2 device driver layer allows adjacent network attackers without authentication to escalate privileges on affected Windows systems. The flaw, tracked under CWE-125, can be triggered by a low-complexity attack from the same WiFi segment or Layer 2 broadcast domain, requiring no user interaction, and yields High availability impact alongside Low confidentiality and integrity exposure. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated adjacent attack surface is meaningful for enterprise mobile workforces on untrusted networks.
Denial of service in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows an unauthenticated adjacent-network attacker to crash or disable the wireless subsystem on affected systems. The flaw stems from an improper conditions check (CWE-754) within the WiFi driver stack, meaning edge-case or malformed network input is not handled safely, leading to complete availability loss of the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, zero-privilege attack vector makes this straightforward to trigger from WiFi range.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.
Improper access control in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows a local unprivileged process to cause a denial of service affecting both the wireless subsystem and, to a lesser extent, downstream system integrity. Affected systems running Intel wireless drivers are exposed to any unprivileged local code - no authentication, no elevated privileges, and no user interaction are required. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Denial-of-service in Intel PROSet/Wireless WiFi Software for Windows (Ring 2 device driver layer) allows an unauthenticated adjacent-network attacker to crash or disable the wireless driver with no user interaction. The flaw stems from an improper conditions check (CWE-754) in the driver, yielding complete loss of wireless availability on the affected system and minor downstream availability impact on subsequently connected systems. No public exploit or CISA KEV listing exists at time of analysis, and Intel has published an advisory at INTEL-SA-01422.
Intel PROSet/Wireless WiFi Software for Windows contains a null pointer dereference in Ring 0 (kernel space) that an adjacent, unauthenticated attacker can exploit to crash the target system, resulting in a denial of service. The flaw resides in the WiFi kernel driver, meaning a successful trigger causes a kernel panic (BSOD on Windows) with high availability impact on both the vulnerable component and the broader system. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the adjacent-network attack vector and zero-privilege requirement make this relevant for any environment where untrusted parties share a wireless segment with Intel WiFi-equipped Windows endpoints.
Improper access control within Ring 3 (user application space) of Intel processors permits privilege escalation from authenticated local user-level access to higher system privilege levels, with high confidentiality and integrity impact on the vulnerable system. Exploitation demands local access, low-privilege authentication, high attack complexity, and specialized internal knowledge of Intel processor microarchitecture internals - substantially narrowing the realistic attacker population. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, consistent with a threat relevant primarily to sophisticated, targeted adversaries.
Denial of service via improper input validation in Intel Active Management Technology (AMT) and Intel Standard Manageability firmware allows unauthenticated network-adjacent attackers to disrupt the out-of-band management interface. The CVSS 4.0 AT:P designation confirms that specific prerequisites - namely AMT being provisioned and network-accessible - must independently exist before exploitation is possible. No public exploit has been identified at time of analysis, and Intel has disclosed the issue under advisory INTEL-SA-01427.
Protection mechanism failure in Intel Data Center Attestation Primitives (Intel DCAP) enables unauthenticated network-based attackers with specialized internal knowledge to undermine the integrity of the attestation system and expose confidential data from downstream systems relying on SGX enclave verification. The vulnerability (CWE-693) is particularly impactful in confidential computing environments where DCAP serves as the trust anchor for SGX workload isolation. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01449 addressing this issue.
Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.
Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the `data->streams[]` array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.
Out-of-bounds bitmap write in the Linux kernel's Intel ICE SR-IOV driver allows a malicious Virtual Function guest to crash the host kernel or potentially escalate privileges to the host. The vulnerable function ice_parser_profile_init unconditionally passes caller-controlled ptype values from VIRTCHNL_OP_ADD_RSS_CFG into set_bit() against a statically sized 1024-bit bitmap, permitting a value such as 0xffff to write beyond the bitmap boundary and trigger a kernel NULL pointer dereference. No public exploit code has been identified and EPSS exploitation probability is low at 0.18%, but the CVSS 8.8 score and confirmed crash reproducibility signal real urgency for SR-IOV multi-tenant environments where stable-branch patches are already available.
Unbounded retry loops in BC-FJA's JNI native entropy layer cause calling threads to hang indefinitely when Intel RDSEED or RDRAND instructions persistently fail, producing a non-interruptible thread-level denial of service in any Java FIPS application backed by bc-fips 2.1.x before 2.1.3. The affected JNI seeding routine re-issues the CPU entropy instruction without any iteration limit whenever the carry flag signals failure - a condition reproducible by hardware entropy source faults, DRBG exhaustion under heavy multi-core contention, or hypervisors that do not forward these Intel instructions to guest VMs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the conditions are routinely present in virtualized environments where hypervisors commonly withhold RDRAND/RDSEED forwarding, making this a realistic operational risk for enterprise Java FIPS deployments in cloud or VM-based infrastructure.
Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.
Denial of service in the Linux kernel's Intel iwlwifi 'mld' Wi-Fi driver allows a firmware crash on Intel BE201/Wi-Fi 7 adapters to spiral into sustained resource exhaustion. Because iwl_mld_tx_from_txq() failed to check the in_hw_restart flag, TX frames kept being dequeued and pushed to dead firmware, each returning -EIO and being freed in a tight loop that burns CPU and churns skb allocations, causing slab fragmentation and memory pressure. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and the issue is not on CISA KEV; it is a reliability/availability bug that manifests under real load, not an attacker-driven remote exploit.
Local privilege-impacting memory corruption in the Linux kernel's Intel ice network driver allows a double-free of a transmit buffer's skb when the TX offload paths fail. When ice_tso() or ice_tx_csum() return an error, ice_xmit_frame_ring() frees the skb but leaves the 'first' tx_buf still marked ICE_TX_BUF_SKB, so a later ice_clean_tx_ring() during interface teardown frees the same skb a second time. Carries a CVSS 3.1 base of 7.8 (AV:L/PR:L), but with a low EPSS of 0.15% (5th percentile), no KEV listing, and no public exploit identified at time of analysis.
Race condition in the Linux kernel's Intel VT-d IOMMU driver allows a local low-privileged attacker to trigger inconsistent PASID table state during domain replacement, potentially producing spurious IOMMU faults and unpredictable DMA behavior with cross-scope impact. The flaw stems from non-atomic updates to 512-bit PASID entries while the Present bit is set, and no public exploit identified at time of analysis despite a high CVSS score driven by the scope-changed local attack surface.
Kernel memory corruption in the Linux iWARP Connection Manager (RDMA/iwcm) subsystem can crash systems running RDMA workloads on iWARP-capable hardware such as Intel E830 adapters. The bug, introduced by commit e1168f0 ('RDMA/iwcm: Simplify cm_event_handler()'), causes workqueue list corruption when iwcm_work items from a free list are reused while still queued, triggering a kernel BUG and panic. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 5th percentile), despite a CVSS base score of 9.8.
Out-of-bounds array access in the Linux kernel's Intel Discrete Graphics MTD driver (mtd_intel_dg.c) lets a local actor trigger kernel memory corruption when the driver enumerates NVM regions before nregions is initialized. The flaw, caught by UBSAN as an array-index-out-of-bounds at line 750, affects systems running kernel 6.17 through the pre-patch 6.18/6.19 series with Intel discrete graphics hardware. No public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.02%, 4th percentile).
Race condition in Linux kernel Intel VT-d IOMMU driver (iommu/vt-d) allows torn reads of Scalable Mode PASID table entries during teardown, producing unpredictable behavior or spurious faults on systems with Intel VT-d enabled. The flaw stems from zeroing the entire 64-byte PASID entry while the Present bit is still set, violating the VT-d spec's invalidation guidance. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but a vendor patch is available across multiple stable branches.
Denial of service in the Linux kernel's EFI unaccepted-memory handling allows a boot-time kernel panic on confidential-computing guests, affecting kernels from 6.6 through the 6.19/7.0 development line. The reserve_unaccepted() routine miscalculates the memblock reservation size when the unaccepted memory table is not page-aligned, leaving the table's tail unreserved so it can be overwritten or rendered inaccessible, triggering a panic in accept_memory(). It is observed on Intel TDX VMs with larger memory sizes (e.g. >64GB); there is no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are configured without hardware crypto acceleration, allowing remote unauthenticated attackers to cause denial of service via undisclosed traffic patterns. CVSS 7.5 (High) with network attack vector and no prerequisites. EPSS data not provided, no CISA KEV listing identified, indicating theoretical rather than observed exploitation. Vendor patch available per F5 advisory K000158082.
Local privilege escalation in Intel QuickAssist Technology (QAT) software drivers for Windows before version 1.13 lets an authenticated low-privileged user elevate to higher privileges through improper input validation in a Ring 3 user-application code path. The flaw was reported by Intel PSIRT (INTEL-SA-01387) and carries a CVSS 4.0 base of 8.5, but there is no public exploit identified at time of analysis and EPSS is a low 0.03% (8th percentile). SSVC scores exploitation as none and not automatable, consistent with a driver bug that requires prior local, authenticated access.
Local privilege escalation in Intel QuickAssist Technology (QAT) software drivers for Windows before version 1.13 lets an authenticated, unprivileged local user escalate to higher privileges via an out-of-bounds write (CWE-787) in Ring 3 user-application code. The flaw carries a CVSS 4.0 base score of 8.5 with total technical impact but is not known to be exploited - CISA's SSVC framework rates exploitation as 'none' and EPSS is negligible at 0.01% (3rd percentile), with no public exploit identified at time of analysis.
Improper access control in all versions of Intel Vision software allows a remote, unauthenticated attacker to trigger denial of service and, under low-complexity conditions, achieve remote code execution against the Ring 3 user-application layer. The CVSS 4.0 base score of 8.8 reflects high confidentiality impact with lesser integrity and availability effects; there is no public exploit identified at time of analysis, and EPSS is low at 0.20% (42nd percentile). Intel published advisory SA-01457 and CISA's SSVC framework rates exploitation as none but technical impact as total.
Local privilege-driven data corruption in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 allows a privileged local adversary to trigger an out-of-bounds write (CWE-787) in a Ring 1 device driver, causing denial of service and integrity loss. The flaw affects the vulnerable system's integrity and availability (both High) with no confidentiality impact, and carries a CVSS 4.0 base score of 8.3. There is no public exploit identified at time of analysis, and the EPSS probability is negligible at 0.01%.
Local privilege escalation in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger a Ring 1 device-driver buffer overflow to execute arbitrary code and take total control of the host. The flaw carries a CVSS 4.0 base score of 9.3 with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis, and the EPSS score is negligible at 0.01% (3rd percentile), consistent with the SSVC verdict of no known exploitation.
Local privilege-abusing denial of service and information disclosure in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger an out-of-bounds read (CWE-125) in the Ring 1 device-driver layer, potentially crashing the host and exposing adjacent memory. The flaw carries a CVSS 4.0 base score of 8.3 driven by high confidentiality and availability impact plus a scope change into subsequent systems. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC rates exploitation as 'none' and non-automatable.
Local privilege escalation in Intel QuickAssist Adapter 8960 software before version 1.13 allows an authenticated, low-privileged user to abuse an untrusted pointer dereference in a Ring 3 user-application component to gain elevated privileges on the host. The flaw yields total impact (high confidentiality, integrity, and availability) on the affected system and carries a CVSS 4.0 base score of 8.5. There is no public exploit identified at time of analysis, and EPSS rates near-term exploitation probability at just 0.01%.
Integer overflow in Linux kernel's i915 graphics driver corrupts memory mapping for DRM/GEM shmem objects larger than 4GB, causing kernel warnings, potential crashes, and incorrect memory access when Intel graphics hardware processes large buffer objects. The vulnerability manifests when scatterlist length fields overflow during folio page allocation, leading to premature termination of backing page iteration. Patch available across multiple stable kernel branches (6.6.130, 6.12.78, 6.18.19, 6.19.9, 7.0) per upstream commits. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
Stack buffer overflow in Sandboxie-Plus SbieSvc proxy service enables SYSTEM privilege escalation from sandboxed processes, including Security Hardened Sandboxes. Attackers chain an information disclosure (returning up to 32KB uninitialized stack memory with ASLR/stack cookie bypass) with an unbounded memcpy overflow in the GetRawInputDeviceInfoSlave IPC handler. Intel CET shadow stacks block ROP exploitation but not the information leak itself. Vendor-released patch available in version 1.17.3. No public exploit identified at time of analysis, but attack complexity is rated high (AC:H) with low privilege requirements (PR:L), making this viable for motivated attackers targeting sandbox environments.
Use-after-free in Linux kernel Bluetooth Intel driver enables local privilege escalation to kernel code execution. Affects Linux kernel 4.3 through 7.0-rc5, with patches available in versions 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0. Exploitation requires local authenticated access with low privileges (CVSS PR:L). EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No public exploit code or active exploitation confirmed at time of analysis, though technical details in CVE description provide implementation roadmap.
Attested TLS relay attacks in Cocos AI confidential computing system versions 0.4.0 through 0.8.2 enable attackers to impersonate genuine TEE-protected services on AMD SEV-SNP and Intel TDX platforms by extracting ephemeral TLS private keys and redirecting authenticated sessions. The architectural flaw allows an attacker with physical access or side-channel capabilities to relay attestation evidence to a different endpoint, breaking the authentication binding between the TEE and the client. No vendor-released patch is available; the vulnerability affects a specialized confidential computing platform with low EPSS probability (formal EPSS score not provided in input) and no public exploit identified at time of analysis, though formal ProVerif verification confirms the attack feasibility.
This vulnerability in Intel EPT (Extended Page Tables) paging code within Xen allows information disclosure through a use-after-free condition in cached EPT state management. When paging structures are freed before cached EPT state is flushed, stale entries can persist in the EPT cache pointing to memory ranges outside the guest's intended ownership, enabling unauthorized memory access. Xen across multiple versions is affected, with Ubuntu tracking the issue at medium priority across 7 releases and Debian across 7 releases, making this a widespread concern for virtualization infrastructure.
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously crafted web content, with Apple confirming active exploitation on Intel-based Mac systems. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS 8.8 score requiring only user interaction (visiting a malicious page) to achieve remote code execution. EPSS at 1.55% (81st percentile) is moderate but the KEV listing signals real-world targeted abuse against Apple's WebKit-based browsing stack.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote code execution through crafted log messages, affecting virtually every Java application on Earth and triggering the largest vulnerability remediation effort in history.
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Local privilege escalation to SYSTEM in Intel Ethernet diagnostics driver (IQVW32.sys/IQVW64.sys versions before 1.3.1.0) allows authenticated Windows users to execute arbitrary code with kernel privileges via crafted IOCTL calls to device driver interfaces. CISA confirms active exploitation in the wild (KEV-listed). Multiple public proof-of-concept exploits demonstrate exploitability across four IOCTL handlers (0x80862013, 0x8086200B, 0x8086200F, 0x80862007). With 4.99% EPSS probability (90th percentile) and confirmed real-world abuse, this represents a critical risk for systems with Intel network adapters where the diagnostic driver remains installed and unpatched.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.6%.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%.
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() In iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses the out_free_eeprom_blob label. Consequently, error paths triggered after successfully parsing the EEPROM free priv->nvm_data but leak priv->eeprom_blob. Fix this memory leak by reordering the error handling labels so that out_free_eeprom falls through to out_free_eeprom_blob. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc6. An x86_64 allyesconfig build showed no new warnings. As we do not have supported Intel DVM wireless hardware and firmware to test with, no runtime testing was able to be performed.
In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() The q->replay_state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup_user(). Return an error if q->replay_state is not empty. Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit f6b6cc1118bdbc4265fa8b3bdf8565b26f13e56e)
In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in mem_write() In mem_write(), the temporary array returned by parse_int_array_user() must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so it is freed automatically on return. This also moves the array declaration next to parse_int_array_user() as required by cleanup.h usage guidelines.
Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.
Transient execution information disclosure in Intel processors allows a Ring 0 (kernel or hypervisor level) adversary to leak sensitive data across security boundaries into a subsequent system context. The flaw stems from incorrect data forwarding during speculative execution, a class of hardware-level side-channel vulnerability similar to Spectre-class attacks, requiring local access with high privileges and high attack complexity. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation enables high-confidentiality-impact cross-boundary data exposure, threatening hypervisor isolation guarantees critical in virtualized and cloud environments.
Firmware improper input validation in Intel Xeon processors enables a highly privileged local adversary operating within System Management Mode (SMM) or startup code context to alter the integrity of subsequent system components. The CVSS 4.0 vector confirms local-only access (AV:L), high complexity (AC:H), presence-required attack conditions (AT:P), and a high-privilege prerequisite (PR:H), with zero confidentiality or availability impact - only downstream integrity degradation (SI:H). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world exploitation risk firmly in the advanced persistent threat category rather than opportunistic attack.
Incomplete cleanup (CWE-459) in UEFI firmware for select Intel reference platforms allows a high-privileged local system software adversary to read sensitive residual data that was not properly purged from firmware memory or registers, resulting in high confidentiality impact on the subsequent system layer. The vulnerability requires specific attack conditions (AT:P) and is scoped to Intel reference platforms identified in advisory INTEL-SA-01437. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Privilege escalation in Intel(R) Transfer Learning Tool before version v0.7 stems from a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling unauthenticated remote attackers to elevate privileges under specific attack conditions. The flaw affects confidentiality, integrity, and availability at a low severity each, with no subsequent system-level impact confirmed. No public exploit code or CISA KEV listing exists at time of analysis, and Intel has published advisory INTEL-SA-01499 addressing this issue.
Intel Software Guard Extensions Data Center Attestation Primitives (SGX DCAP), operating at Ring 0 kernel privilege level, omits security-relevant information during attestation operations, enabling a privileged local attacker under high-complexity conditions to cause denial of service and high-integrity data alteration on downstream systems relying on attestation output. The SI:H subsequent-system integrity impact is the critical concern: systems that consume SGX attestation results - cloud orchestrators, confidential VM managers, or trust brokers - may accept manipulated evidence, undermining the core trust guarantees of confidential computing infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H and AC:H prerequisites substantially constrain the realistic attacker pool.
Privilege escalation in Intel Processors operating within Ring 0 environments - kernel, hypervisor, and bare-metal OS - allows an authorized attacker already holding high-privilege access to cross isolation boundaries and achieve high confidentiality and integrity impact on subsequent systems such as hypervisors or co-located virtual machines. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/SC:H/SI:H) confirms the attack is local, high-complexity, and gated behind existing privileged access plus special internal knowledge of processor internals, significantly limiting the exploitable population. No public exploit code and no CISA KEV listing exist at time of analysis, making current real-world risk primarily theoretical but relevant to hardened multi-tenant and virtualized datacenter environments.
Deserialization of untrusted data in Intel Extension for PyTorch (IPEX) versions before 2.8.0 enables local privilege escalation when a victim user opens a maliciously crafted serialized artifact within an IPEX-dependent application. The vulnerability operates at Ring 3 (user-space) and yields low confidentiality, integrity, and availability impact with no subsequent system-level compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Intel Performance Counter Monitor (PCM) before version tag 202604 allows a local authenticated attacker to gain elevated privileges via an untrusted search path (CWE-426) within Ring 3 user-space applications. The attack requires high complexity and passive interaction from a privileged user, producing full high-impact confidentiality, integrity, and availability compromise of the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Insufficient access control granularity in a subsystem of Intel Xeon 6 Scalable processors with Trust Domain Extensions (TDX) enables cross-domain information disclosure. The flaw, classified under CWE-1220, allows an authenticated local adversary with specialized knowledge of processor internals to leak confidential data belonging to a co-resident trust domain or protected virtual machine, while leaving integrity and availability of all systems untouched. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 4.0 scope-change pattern (VC:N/SC:H) signals a meaningful cross-trust-domain confidentiality risk specifically in confidential computing deployments.
Privilege escalation in Intel Xeon 6 processors arises from improper handling of overlapping protected memory ranges when Intel Trust Domain Extensions (TDX) operate within System Management Mode (SMM). An adversary who has already achieved SMM-level access and combines that foothold with a high-complexity, knowledge-intensive attack can break the isolation guarantees that TDX is designed to enforce, achieving unauthorized reads and writes of confidential memory. No public exploit code and no CISA KEV listing are associated with this issue at time of analysis, but the high confidentiality and integrity impact to the vulnerable system makes it significant for confidential-computing deployments.
Insufficient data authenticity verification within Intel Trust Domain Extensions (Intel TDX) at Ring 0 (hypervisor privilege level) enables information disclosure under a high-complexity, locally-mounted attack. A system software adversary already holding hypervisor-level privileges can exploit CWE-345 conditions to expose sensitive Trust Domain memory contents, achieving high confidentiality impact on the vulnerable system with limited integrity effects on both the vulnerable and subsequent systems. No public exploit code exists and this vulnerability has not been listed in CISA KEV, with the vendor-confirmed CVSS 4.0 score of 5.6 (Medium) accurately reflecting the constrained attack profile.
Privilege escalation in Intel Workload Services Framework software affects the Ring 3 user-application layer, where a protection mechanism failure (CWE-693) allows an unprivileged process to gain elevated privileges when a concurrently active privileged user provides passive interaction. The attack is local, requires attack prerequisites to be met (AT:P per CVSS 4.0), and achieves full compromise of the vulnerable system's confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis; this is a vendor-disclosed advisory via INTEL-SA-01467.
Integer overflow in Intel Slim Bootloader UEFI firmware exposes systems to limited information disclosure and denial of service. Exploitation requires local, authenticated access with active user interaction, yielding only low-impact confidentiality and availability consequences with no integrity impact. No active exploitation has been identified; the CVSS 4.0 score of 2.4 reflects the constrained exploitation conditions and limited blast radius.
Improper input validation in the vLLM Hardware Plugin for Intel Gaudi software (versions before 0.16.0) allows a locally authenticated user to cause a denial of service, crashing or degrading availability of the affected system. The vulnerability operates within Ring 3 (user application space) and requires only low-privilege local access with no user interaction, making it viable for insider threat or compromised-account scenarios. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis; Intel has released a fix in version 0.16.0.
Out-of-bounds write (CWE-787) in Intel Slim Bootloader firmware enables a denial of service condition on the local system. Exploitation requires a privileged local account and the presence of specific attack preconditions (AT:P per CVSS 4.0), and impact is confined to low availability on the vulnerable system with no confidentiality or integrity consequences. Intel disclosed this issue through advisory INTEL-SA-01475 with a CVSS 4.0 base score of 1.8; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Privilege escalation in Intel(R) oneCCL Bindings for PyTorch before v2.8.0 stems from a protection mechanism failure (CWE-693) in Ring 3 user application space, enabling a local adversary - operating in conjunction with a high-privilege user through passive interaction - to escalate privileges with full confidentiality, integrity, and availability impact on the vulnerable system. The CVSS 4.0 score of 5.4 reflects meaningful exploitation constraints: specific attack requirements must be present (AT:P), high privileges are already required (PR:H), and passive interaction from a privileged user is needed (UI:P). No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis.
Use-after-free in the kernel-mode (Ring 0) driver component of Intel PROSet/Wireless WiFi Software for Windows enables a local denial-of-service condition by crashing the affected system. The flaw resides in the most privileged execution ring on x86/x64, meaning a successful trigger causes a kernel panic (BSOD) with no containment boundary below the OS. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified at time of analysis, and the combination of local-only access with high attack complexity substantially constrains real-world risk.
Privilege escalation in Intel AI Reference Models before v3.4.1 stems from a protection mechanism failure (CWE-693) within Ring 3 user-space applications, allowing unprivileged software to gain elevated access when a privileged user is passively present under specific deployment conditions. The vulnerability carries full confidentiality, integrity, and availability impact on the vulnerable system, though scope is contained with no subsequent-system impact. No public exploit has been identified at time of analysis; Intel has issued a fix in version v3.4.1 per advisory INTEL-SA-01432.
Heap-based buffer overflow in Intel Open Volume Kernel Library (Open VKL) before version 2.0.2 allows a local authenticated attacker with low privileges to cause denial of service against applications consuming the library. Operating entirely in Ring 3 (user space), the flaw requires no user interaction and carries low attack complexity, making it straightforward to trigger for any local account on an affected system. No public exploit code and no active exploitation have been identified; Intel has released version 2.0.2 as the corrective fix per advisory INTEL-SA-01459.
Privilege escalation affects Intel's LLM Library for PyTorch operating within Ring 3 (user application space) due to a protection mechanism failure (CWE-693). An adversary with access to an unprivileged software context, combined with the presence of a privileged user and passive user interaction, can exploit this flaw locally to gain elevated privileges with high impact on confidentiality, integrity, and availability. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.4 reflects the restrictive local access and high-privilege prerequisites that limit real-world exploitability.
Privilege escalation in Intel Neural Compressor software before v3.7 stems from improper input validation within Ring 3 (user application space), allowing a locally authenticated low-privileged user to elevate privileges on the affected host. The CVSS 4.0 vector confirms local access with low complexity, no special attack requirements, and no user interaction needed - meaning exploitation is straightforward once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to the vulnerable system with no lateral scope change.
Denial of service via a TOCTOU race condition in the Intel NPU Driver for Windows affects all current versions operating at Ring 1 (device driver layer). An authenticated local attacker with low privileges can exploit a window between the driver's resource state check and its use, resulting in high availability impact and low integrity impact to the vulnerable system. No active exploitation has been confirmed, and the high attack complexity plus specific attack prerequisites substantially limit opportunistic exploitation.
Privilege escalation in Intel Neural Compressor software before v3.6 stems from a protection mechanism failure (CWE-693) within the Ring 3 user-application layer. A local attacker operating with high privileges, in conjunction with specific attack requirements and passive user interaction, can exploit this flaw to elevate privileges with high confidentiality, integrity, and availability impact on the vulnerable system. Intel has issued advisory INTEL-SA-01454 and released v3.6 as the remediated version; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Intel AI Containers before v0.4.0 exposes a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling a local attacker already holding high privileges to further escalate privileges with full confidentiality, integrity, and availability impact on the vulnerable system. Exploitation requires passive user interaction and specific attack conditions (AT:P), substantially limiting the realistic attack population to multi-tenant AI container deployments where privileged users must be constrained. No public exploit code has been identified and this vulnerability does not appear in CISA KEV at time of analysis.
Local privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows unprivileged local code execution by exploiting improper authentication within the device driver layer. An attacker with only local access and no required privileges can bypass authentication checks in the Ring-2 driver tier, ultimately achieving code execution that results in high confidentiality impact on the broader host system alongside low integrity and availability impacts. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.