CVE-2022-38136

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel Fortran Compiler for Windows before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
n/a	Intel(R) oneAPI DPC++/C++ Compiler for Windows and IntelÂ® Fortran Compiler for Windows before version 2022.2.1 for some Intel(R) oneAPI Toolkits	Intel(R) oneAPI DPC++/C++ Compiler for Windows and IntelÂ® Fortran Compiler for Windows before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.htmlVendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.htmlVendor Advisory

Timeline

Published: Feb 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-381378.8Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress.CVE-2022-381387.5The Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 11.2.0 or earlier and CVE-2022-381398.8Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress.CVE-2022-38146.5A vulnerability classified as problematic was found in Axiomatic Bento4. This vulnerability affects unknown code of the component mp4decrypt CVE-2022-381408.8Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.CVE-2022-381416.5Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from CVE-2022-381429.8Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway s CVE-2022-381439.8A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp f CVE-2022-381448.8Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.CVE-2022-381455.4Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta CVE-2022-381465.4Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3).CVE-2022-381475.4Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).