CVE-2025-32732
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Intel(R) QAT Windows software before version 2.6.0 contains a buffer overflow in Ring 3 (user applications) that may allow denial of service. The attack requires an authenticated user and local access, with no user interaction.
Risk Assessment
An authenticated local attacker could cause a crash or system destabilization, resulting in denial of service. Impact on confidentiality and integrity is low, while availability impact is high.
Recommendation
Update Intel QAT Windows software to version 2.6.0 or later. Restrict local access to systems running this software to trusted users.
Other vulnerabilities in Intel QAT Windows software
See all- CVE-2025-32088Low
Improper conditions check in some Intel(R) QAT Windows software before version 2.6.0 within Ring 3 (user applications) may allow a denial of service. The attack requires an authenticated user and local access, with impact limited to availability (low).
- CVE-2025-27713High
Out-of-bounds write for some Intel(R) QAT Windows software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege via local access without special internal knowledge and requires no user interaction.
Original NVD description (English source)
Buffer overflow for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS