CVE-2026-42917

MediumCVSS 4.8/10Last modified Nov 12, 2026

Description

Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 4.0 4.8/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
n/a	Intel(R) Neural Compressor software	before version 3.8

References

https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-429196.7A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A CVE-2026-42922.7An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editabl CVE-2026-429207.5When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic CVE-2026-429229.8A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request CVE-2026-429235.3NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negativ CVE-2026-429248.7An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP CVE-2026-429265.8When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker m CVE-2026-429298.3Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.CVE-2026-42935.3The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the vict CVE-2026-429308.7When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restriction CVE-2026-429316.5Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint CVE-2026-429325.3Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable