CVE-2026-20913

MediumCVSS 5.3/10Last modified Aug 31, 2026

Description

Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Aug 31, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-209145.5Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 2.6.0 within Ring 3: User Applications may allow CVE-2026-209155.4Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pendinCVE-2026-209168.1An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint oCVE-2026-209174.0Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0:CVE-2026-209187.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authoriCVE-2026-209197.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacCVE-2026-20927.7A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted asseCVE-2026-209207.8Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-209217.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacCVE-2026-209227.8Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.CVE-2026-209237.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-209247.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.