CVE-2025-32446
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Intel QuickAssist Technology software before version 2.6.0 contains an untrusted pointer dereference in Ring 3 (user applications) that may allow privilege escalation. The attack requires an authenticated user and local access, with no user interaction.
Risk Assessment
An authenticated local attacker could manipulate data or gain higher privileges, compromising system integrity. Impact on confidentiality and availability is assessed as none.
Recommendation
Update Intel QuickAssist Technology software to version 2.6.0 or later. Restrict local access to systems running this software to trusted users.
Other vulnerabilities in Intel QuickAssist Technology
See all- CVE-2025-33000High
Improper input validation for some Intel QuickAssist Technology before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege via local access without special internal knowledge and requires no user interaction.
- CVE-2025-30509Low
Improper input validation in Intel QuickAssist Technology software before version 2.6.0 within Ring 3 (user applications) may allow an escalation of privilege. An authenticated attacker with local access may enable data manipulation.
Original NVD description (English source)
Untrusted pointer dereference for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS