CVE-2025-33000
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Improper input validation for some Intel QuickAssist Technology before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege via local access without special internal knowledge and requires no user interaction.
Risk Assessment
An authenticated user can escalate privileges, potentially impacting confidentiality, integrity, and availability of the system. The risk affects systems with Intel QAT before version 2.6.0 installed.
Recommendation
Update Intel QuickAssist Technology to version 2.6.0 or later. Restrict local access to trusted users and monitor for privilege escalation attempts.
Other vulnerabilities in Intel QuickAssist Technology
See all- CVE-2025-32446Medium
Intel QuickAssist Technology software before version 2.6.0 contains an untrusted pointer dereference in Ring 3 (user applications) that may allow privilege escalation. The attack requires an authenticated user and local access, with no user interaction.
- CVE-2025-30509Low
Improper input validation in Intel QuickAssist Technology software before version 2.6.0 within Ring 3 (user applications) may allow an escalation of privilege. An authenticated attacker with local access may enable data manipulation.
Original NVD description (English source)
Improper input validation for some Intel QuickAssist Technology before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS