CVE-2025-26405

MediumCVSS 5.9/10Last modified Oct 19, 2026

Description

Improper control of dynamically-managed code resources for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-913

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2025
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-264086.1The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full acce CVE-2025-264096.8A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to CVE-2025-26419.8A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. Affected by this issue is CVE-2025-264109.8The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovere CVE-2025-264118.8An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python CVE-2025-264126.8The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on t CVE-2025-264137.5Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer an CVE-2025-264169.8In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to r CVE-2025-264174.0In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage CVE-2025-264187.8In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to CVE-2025-264193.3In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to local CVE-2025-26429.8A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.0. This affects an unknown part o