CVE Vulnerability Catalog

The Instrumentation and Tracing Technology API (ITT API) before version 3.25.4 has an uncontrolled search path vulnerability in Ring 3 user applications. This may allow an authenticated user to escalate privileges via local access with user interaction.

Uncontrolled search path in Intel Graphics Software before version 25.22.1502.2 within Ring 3 user applications may allow privilege escalation. An authenticated user with local access and user interaction could exploit this.

Uncontrolled search path in System Event Log Viewer Utility (all versions) within Ring 3 user applications may allow privilege escalation. An authenticated user with local access and user interaction could exploit this.

Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 contains a time-of-check time-of-use (TOCTOU) race condition in Ring 3 (user applications) that may allow denial of service. The attack requires an authenticated user, adjacent access, and active user interaction.

Incorrect default permissions in Intel(R) PresentMon before version 2.3.1 may allow an authenticated user to escalate privileges. The attack requires local access, high complexity, and user interaction, and may impact confidentiality, integrity, and availability.

A vulnerability in Intel Driver and Support Assistant before version 25.2 involves an uncontrolled search path in user applications (Ring 3). It may allow local code execution and privilege escalation by an authenticated user with high attack complexity and required user interaction.

Intel(R) Distribution for Python software installers before version 2025.2.0 contain an uncontrolled search path in Ring 3 (user applications) that may allow privilege escalation. The attack requires an authenticated user, local access, and active user interaction, with high complexity.

A time-of-check time-of-use race condition in ACAT before version 3.13 may allow an authenticated user to cause a denial of service. The attack requires local access, high complexity, and user interaction, impacting system availability.

Intel(R) Neural Compressor software before version v3.4 contains improper neutralization in Ring 3 (user applications) that may allow privilege escalation. The attack requires an authenticated user, local access, and active user interaction.

Incorrect default permissions in Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 may allow an authenticated user to escalate privileges. The attack requires local access, high complexity, and user interaction, and may impact confidentiality, integrity, and availability.

Untrusted pointer dereference in some Intel(R) QAT Windows software before version 2.6.0 within Ring 3: User Applications may allow an information disclosure.

Uncontrolled resource consumption in Gaudi software before version 1.21.0 within Ring 3: User Applications may allow a denial of service. An authenticated user with a low-complexity attack can cause a denial of service via local access.

Incorrect default permissions in Intel Processor Identification Utility before version 8.0.43 within Ring 3 user applications may allow local code execution and privilege escalation. An authenticated user with local access and user interaction could exploit this.

Null pointer dereference in Intel(R) QAT Windows software before version 2.6.0 within Ring 3: User Applications may allow a denial of service. An authenticated user with a low-complexity attack can cause a denial of service via local access.

Improper control of dynamically-managed code resources in Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. An unprivileged authenticated user with a low-complexity attack can cause a denial of service via local access, requiring passive user interaction.

A protection mechanism failure in some Intel(R) NPU Drivers within user applications (Ring 3) may allow a denial of service. An authenticated attacker with low attack complexity can trigger it without user interaction.

Uncontrolled search path in Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User Applications may allow an escalation of privilege. An unprivileged authenticated user with a high-complexity attack can escalate privileges via local access, requiring active user interaction.

An improper link resolution before file access ('link following') in some Intel(R) Server Configuration Utility and Intel(R) Server Firmware Update Utility software before version 16.0.12 may allow privilege escalation. An authenticated attacker with high attack complexity and user interaction could exploit it.

Improper privilege management in some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. An unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This may occur via network access without special internal knowledge and requires no user interaction.

Protection mechanism failure in Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. A privileged authenticated user with a high-complexity attack can escalate privileges via local access, requiring passive user interaction.