CVE-2025-30509
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Improper input validation in Intel QuickAssist Technology software before version 2.6.0 within Ring 3 (user applications) may allow an escalation of privilege. An authenticated attacker with local access may enable data manipulation.
Risk Assessment
A local authenticated user could exploit the flaw to escalate privileges and manipulate data, affecting system integrity. The risk is limited as it requires local access and does not disclose data.
Recommendation
Update Intel QuickAssist Technology to version 2.6.0 or later. Restrict local access to applications using this library to trusted users.
Other vulnerabilities in Intel QuickAssist Technology
See all- CVE-2025-33000High
Improper input validation for some Intel QuickAssist Technology before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege via local access without special internal knowledge and requires no user interaction.
- CVE-2025-32446Medium
Intel QuickAssist Technology software before version 2.6.0 contains an untrusted pointer dereference in Ring 3 (user applications) that may allow privilege escalation. The attack requires an authenticated user and local access, with no user interaction.
Original NVD description (English source)
Improper input validation for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS