CVE-2025-35979
MediumSummary
Vulnerability in Intel processors allows exposure of sensitive information via shared microarchitectural predictor state during transient execution in VMX non-root (guest) operation. An unprivileged software adversary with an authenticated user can exploit this state to access data.
Risk Assessment
The risk involves potential leakage of sensitive data, such as cryptographic keys or passwords, from virtual machines running on affected Intel processors, leading to confidentiality breaches in multi-tenant environments.
Recommendation
Immediately apply microcode updates provided by the vendor and implement isolation mechanisms, such as disabling predictor sharing or using dedicated hardware solutions.
Other vulnerabilities in Intel Processors
See all- CVE-2026-20917Medium
Some Intel(R) processors are vulnerable to information disclosure caused by incorrect data forwarding during transient execution in Ring 0 (hypervisor and kernel). A system software adversary with a privileged user and a high complexity attack may enable data exposure. This requires local access but no user interaction. The vulnerability may impact system confidentiality (high), but not integrity or availability.
- CVE-2026-20760Medium
Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring 0: Hypervisor may allow an escalation of privilege. The attack requires a privileged user, low complexity, and local access, with no user interaction. The vulnerability impacts confidentiality, integrity, and availability (high).
- CVE-2026-20716High
Improper access control in some Intel processors in the user application layer may allow an escalation of privilege. The attack requires an authenticated user, high complexity, and special internal knowledge, but no user interaction. The vulnerability impacts confidentiality and integrity (high), with no impact on availability.
- CVE-2025-35973Medium
Improper handling of values in some Intel processors at Ring 0 (kernel, hypervisor, bare metal OS) may allow privilege escalation. An authorized adversary with a privileged user and a high complexity attack can escalate privileges via local access with special internal knowledge and no user interaction. The vulnerability may impact confidentiality and integrity but not availability.
- CVE-2024-28956Medium
A vulnerability in the microarchitecture of Intel processors allows disclosure of sensitive information during transient execution. An authenticated user with local access can potentially read data that should not be accessible.
Original NVD description (English source)
Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) Processors within VMX non-root (guest) operation may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a
Vulnerability data from NVD (NIST) · CISA KEV · EPSS