CVE-2024-28956
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability in the microarchitecture of Intel processors allows disclosure of sensitive information during transient execution. An authenticated user with local access can potentially read data that should not be accessible.
Risk Assessment
The risk involves potential leakage of confidential data, such as cryptographic keys or passwords, by a local attacker. This could lead to system security breaches and loss of information confidentiality.
Recommendation
Apply microcode updates provided by the processor manufacturer and update the system BIOS/UEFI. Also implement process isolation mechanisms and restrict local access to trusted users.
Other vulnerabilities in Intel Processors
See all- CVE-2025-35979Medium
Vulnerability in Intel processors allows exposure of sensitive information via shared microarchitectural predictor state during transient execution in VMX non-root (guest) operation. An unprivileged software adversary with an authenticated user can exploit this state to access data.
- CVE-2026-20917Medium
Some Intel(R) processors are vulnerable to information disclosure caused by incorrect data forwarding during transient execution in Ring 0 (hypervisor and kernel). A system software adversary with a privileged user and a high complexity attack may enable data exposure. This requires local access but no user interaction. The vulnerability may impact system confidentiality (high), but not integrity or availability.
- CVE-2026-20760Medium
Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring 0: Hypervisor may allow an escalation of privilege. The attack requires a privileged user, low complexity, and local access, with no user interaction. The vulnerability impacts confidentiality, integrity, and availability (high).
- CVE-2026-20716High
Improper access control in some Intel processors in the user application layer may allow an escalation of privilege. The attack requires an authenticated user, high complexity, and special internal knowledge, but no user interaction. The vulnerability impacts confidentiality and integrity (high), with no impact on availability.
- CVE-2025-35973Medium
Improper handling of values in some Intel processors at Ring 0 (kernel, hypervisor, bare metal OS) may allow privilege escalation. An authorized adversary with a privileged user and a high complexity attack can escalate privileges via local access with special internal knowledge and no user interaction. The vulnerability may impact confidentiality and integrity but not availability.
Original NVD description (English source)
Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS