CVE-2026-32670

Privilege Escalation via Race Condition in Intel VTune Profiler

Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32672

Null Pointer Dereference in Intel NPU Drivers Causes Local Denial of Service

Null pointer dereference for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-49028

Denial-of-Service via Deserialization in Intel Neural Compressor

Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-57884

Privilege Escalation via Uncontrolled Search Path in Intel Graphics Software

Uncontrolled search path for some Intel(R) Graphics Software before version 26.14.2303.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109802

Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server for ABAP

SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high impact on availability with no impact on confidentiality and integrity.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Sap Netweaver Application Server For Abap Sap Netweaver Application Server For Abap

CVE-2026-33571

Out‑of‑Bounds Read in Intel VTune Profiler Leading to Denial of Service

Out-of-bounds read for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-35060

Missing Authentication Enabling Local Privilege Escalation in AI Playground Software

Missing authentication for critical function for some AI Playground software before version v3.1.1-beta within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-35683

Out‑of‑Bounds Write Leading to Denial of Service in Intel Multi‑Buffer Crypto for IPSec

Out-of-bounds write for some Intel(R) Multi-Buffer Crypto for IPSec within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40426

Integer Underflow Enables Denial of Service in Intel NPU Driver

Integer underflow (wrap or wraparound) for the Intel(R) NPU Driver software before version 1.33.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40427

Local Denial of Service via Use‑After‑Free in Intel QuickAssist Technology Driver

Use after free for some Intel(R) QuickAssist Technology Driver for Windows within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40693

Improper Input Validation in Intel TDX Workload Attestation Allows Denial of Service

Improper input validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40705

Denial of Service via Improper Resource Locking in Intel NPU Drivers

Improper resource locking for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-97401

Unprivileged Command Execution Exploit in Eclipse Kura via ZIP Extraction

In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable "Unprivileged" executor drops to the `kura` user via `su`. A caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected. The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. [1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-28746

Out-of-Bounds Read in Intel Slim Bootloader Causes Denial of Service

Out-of-bounds read in the AuthenticateComponent for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-34489

Untrusted Pointer Dereference Allowing Local Denial of Service in Hyperscan

Untrusted pointer dereference for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Intel

Products

Hyperscan

CVE-2026-35500

Stack‑based Buffer Overflow Allowing Privilege Escalation in Intel Slim Bootloader

Stack-based buffer overflow in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. Startup code and smm adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40216

Out‑of‑Bounds Read in Hyperscan Leading to Local Denial of Service

Out-of-bounds read for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Intel

Products

Hyperscan

CVE-2026-40433

Heap-based Buffer Overflow Leading to Kernel Denial of Service in Intel PROSet Wireless Wi‑Fi Software

Heap-based buffer overflow for some Intel(R) PROSet Wireless Wi-Fi Software for Windows within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-44382

Out‑of‑Bounds Read Causing Denial of Service in Intel Wireless Bluetooth Kernel Driver

Out-of-bounds read for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-44625

Use‑After‑Free in Intel Wireless Bluetooth Driver Causes Local Kernel Denial of Service

Use after free for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—