CVE-2025-27710

MediumCVSS 5.5/10Last modified Oct 19, 2026

Description

Untrusted pointer dereference for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2025
Last modified
Oct 19, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-277116.7Incorrect default permissions for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User AppCVE-2025-277125.7Improper neutralization for some Intel(R) Neural Compressor software before version v3.4 within Ring 3: User Applications may allow an escalCVE-2025-277137.8Out-of-bounds write for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an escalation ofCVE-2025-277146.3An attacker could exploit this vulnerability by uploading arbitrary files via the a specific endpoint, leading to unauthorized remote code CVE-2025-277152.7Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team adminsCVE-2025-277166.5Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB stCVE-2025-277176.7Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privCVE-2025-277188.8Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file upload process of the USB storage fiCVE-2025-277195.3Unauthenticated attackers can query an API endpoint and get device details.CVE-2025-27726.5BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulnerability allows netwoCVE-2025-277207.4The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.CVE-2025-277217.5Unauthorized users can access INFINITT PACS System Manager without proper authorization, which could lead to unauthorized access to system
CVE-2025-27710: Medium severity, CVSS 5.5 | Vulnix