CVE-2025-27713
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Out-of-bounds write for some Intel(R) QAT Windows software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege via local access without special internal knowledge and requires no user interaction.
Risk Assessment
An authenticated user can escalate privileges, potentially impacting confidentiality, integrity, and availability of the system. The risk affects Windows systems with Intel QAT before version 2.6.0 installed.
Recommendation
Update Intel QAT Windows software to version 2.6.0 or later. Restrict local access to trusted users and monitor for privilege escalation attempts.
Other vulnerabilities in Intel QAT Windows software
See all- CVE-2025-32732Medium
Intel(R) QAT Windows software before version 2.6.0 contains a buffer overflow in Ring 3 (user applications) that may allow denial of service. The attack requires an authenticated user and local access, with no user interaction.
- CVE-2025-32088Low
Improper conditions check in some Intel(R) QAT Windows software before version 2.6.0 within Ring 3 (user applications) may allow a denial of service. The attack requires an authenticated user and local access, with impact limited to availability (low).
Original NVD description (English source)
Out-of-bounds write for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS