CVE-2025-35998
HighCVSS 7.9Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Missing protection mechanism for alternate hardware interface in Intel(R) Quick Assist Technology on some Intel Platforms within Ring 0 (Kernel) may allow privilege escalation. A system software adversary with a privileged user, combined with a low complexity attack and special internal knowledge, can locally escalate privileges without user interaction.
Risk Assessment
The risk involves potential local privilege escalation by an attacker, which could compromise system confidentiality and integrity, potentially leading to control over sensitive data or functions.
Recommendation
It is recommended to immediately apply patches provided by Intel through driver or microcode updates, and restrict local system access to trusted users only.
Related vulnerabilities
- CVE-2026-93765Critical
Mongoid contains an unsafe reflection weakness in the document persistence layer. Passing keys from unauthenticated parties can trigger unintended internal method invocation instead of an array update, potentially causing deletion of stored records and unresponsiveness.
- CVE-2026-85497Critical
CareCam CM2507 IP cameras store the root password using a fixed legacy hash that is insufficiently resistant to offline cracking.
- CVE-2026-81321Critical
CM2507 IP cameras store wireless network credentials in cleartext within the device filesystem.
- CVE-2026-77240Critical
WACRM 0.7.0 and earlier has vulnerabilities: row-level security policies allow authenticated users to modify their own role and account ID, enabling privilege escalation and cross-tenant movement. Additionally, match_ai_knowledge_fts and match_ai_knowledge_semantic run as SECURITY DEFINER with no account membership check, allowing non-members to read another tenant's knowledge chunks.
- CVE-2026-84383Critical
libheif from 1.22.0 to 1.23.2 has a heap out-of-bounds write vulnerability. Crafted HEIF/HEIC/AVIF files with nested iden/auxl references cause duplicate Alpha planes with different bit depths, and scale_nearest_neighbor() allocates a buffer based on the first plane's 8-bit depth, leading to an overflow.
- CVE-2026-61682Critical
kcp before 0.31.4 and 0.32.2 fails to strip inbound identity headers (X-Remote-User, X-Remote-Group, X-Remote-Extra-*) before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, gaining full privileges.
- CVE-2026-10858Critical
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 has a heap buffer underflow when processing multi-segment messages, which could allow an authenticated attacker to cause denial of service or arbitrary code execution.
- CVE-2026-10747Critical
IBM MQ Appliance has a heap buffer overflow in protocol message processing before authentication, allowing a remote attacker to cause DoS or potentially execute arbitrary code.
- CVE-2025-53837Critical
XWiki Rendering prior to 14.10.2 and 15.0 RC1 allows any user who can edit their profile or any document to execute arbitrary script macros, including Groovy and Python, leading to remote code execution. The rendering output is included as HTML macro content without further escaping, allowing closure of the HTML macro and injection of script macros with programming rights.
- CVE-2025-15399Critical
IBM Common Licensing Agent 9.0 and ART 9.0 (including subversions) are vulnerable to cross-site request forgery, allowing an attacker to execute malicious actions from a user that the website trusts.
Original NVD description (English source)
Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.