{"id":"CVE-2026-32667","kind":"vulnerability","aliases":["CVE-2026-32667"],"related":[],"title":"Intel VTune Profiler: out-of-bounds write in device drivers enables privilege escalation","description":"Out-of-bounds write for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"Intel VTune Profiler's Ring 1 device driver component has an out-of-bounds write that lets a local, low-privileged user escalate privileges (CVSS 4.0 8.5 High, high impact on confidentiality, integrity and availability). It is one of nine CVEs in Intel advisory INTEL-SA-01477. Intel lists the affected products as VTune Profiler before 2026.0.0, oneAPI Toolkit before 2026.0.0, System Bring-up Toolkit before 2026.0.0, SoC Watch before 2026.1 and SEP before 5.58.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Intel VTune Profiler","fixed":["2026.0.0"],"affected":"< 2026.0.0","ecosystem":"vendor"},{"name":"Intel oneAPI Toolkit","fixed":["2026.0.0"],"affected":"< 2026.0.0","ecosystem":"vendor"},{"name":"Intel System Bring-up Toolkit","fixed":["2026.0.0"],"affected":"< 2026.0.0","ecosystem":"vendor"},{"name":"Intel SoC Watch","fixed":["2026.1"],"affected":"< 2026.1","ecosystem":"vendor"},{"name":"Sampling Enabling Product (SEP)","fixed":["5.58"],"affected":"< 5.58","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","intel","linux","local-privilege-escalation","oneapi","vtune","windows"],"not_affected_if":["not-installed","vtune-2026.0.0-or-later","vtune-not-installed"],"how_to_check":"Find VTune Profiler, oneAPI Toolkit, System Bring-up Toolkit, SoC Watch or SEP (the sep drivers) on the machine and check their versions. Anything older than VTune/oneAPI/Bring-up 2026.0.0, SoC Watch 2026.1 or SEP 5.58 is in Intel's affected list. Intel's advisory does not name the driver files.","fix":"Update Intel VTune Profiler to 2026.0.0 or later. That release includes SoC Watch 2026.1 or later and SEP 5.58 or later. Update oneAPI Toolkit and System Bring-up Toolkit to 2026.0.0 or later.","status":"open","published_at":"2026-11-10T17:17:40+00:00","first_seen_at":"2026-11-10T17:22:42+00:00","triaged_at":"2026-11-10T17:23:54+00:00","updated_at":"2026-11-10T17:26:26+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T17:23:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel VTune Profiler: out-of-bounds write in device drivers enables privilege escalation","impact":"high","summary":"Intel VTune Profiler's Ring 1 device driver component has an out-of-bounds write flaw. A local user with an ordinary account can escalate privileges and gain high confidentiality, integrity and availability impact on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel","vtune","windows","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains kernel-level control of the system","analyst_note":"Find Intel's security advisory for VTune Profiler and the affected and fixed version ranges, and the driver component names, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-32667.","how_to_check":"- Check whether VTune Profiler is installed on the machine, for example by looking for its install directory in Program Files or /opt.\n- Compare the installed VTune version against the affected ranges in Intel's advisory: unknown from the sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["vtune-not-installed"],"who_is_affected":"Machines where Intel VTune Profiler is installed and local users can log in or run code. Systems without VTune installed are not affected. The sources do not name the affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000736,"input_tokens":4665,"output_tokens":538,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Intel's security advisory for VTune Profiler and the affected and fixed version ranges, and the driver component names, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-32667.","search":"'-2026':16A,19A '-32667':17A,20A '01477':99B '1':55B,144C '2026.0.0':109B,113B,120B '2026.1':124B '4.0':77B '5.58':128B '8.5':78B 'access':178C 'adversari':155C 'advisori':95B 'affect':103B 'allow':148C 'attack':165C,180C 'authent':158C 'avail':86B,205C,220C 'bound':7A,64B,132C 'bring':30A,116B 'bring-up':29A,115B 'combin':160C 'complex':164C 'compon':58B 'confidenti':83B,200C,215C 'cve':15A,18A 'cves':92B 'cvss':76B 'devic':10A,56B,145C 'driver':11A,57B,146C 'enabl':12A,167C 'enabling':37A 'escal':14A,46B,74B,150C,168C 'high':79B,80B,201C,203C,206C 'impact':81B,198C,222C 'infrastructur':40B 'integr':84B,202C,217C 'intel':1A,21A,24A,27A,33A,41B,50B,94B,97B,100B,136C 'intel-sa':96B 'interact':193C 'intern':187C 'knowledg':188C 'let':67B 'linux':42B 'list':101B 'local':44B,69B,177C 'local-privilege-escal':43B 'low':71B,163C 'low-privileg':70B 'may':147C,166C,173C,197C 'nine':91B 'none':216C,218C,221C 'occur':175C 'one':89B 'oneapi':25A,47B,110B 'out-of-bound':4A,61B,129C 'potenti':174C,195C 'present':184C 'privileg':13A,45B,72B,75B,152C,170C 'product':38A,104B 'profil':3A,52B,107B,140C 'profiler':23A 'r':137C 'requir':181C,190C 'result':172C,211C 'ring':54B,143C 'sa':98B 'sampling':36A 'sep':39A,126B 'soc':34A,121B 'softwar':141C,154C 'special':186C 'subsequ':213C 'system':28A,114B,210C,214C 'tm':139C 'toolkit':26A,32A,111B,118B 'unprivileg':153C 'up':31A 'user':73B,159C,192C 'via':176C 'vtune':2A,22A,48B,51B,106B,138C 'vulner':196C,209C 'watch':35A,122B 'window':49B 'within':142C 'without':185C 'write':8A,65B,133C","nicknames":[],"mitigations":[],"who_affected":"Developers and performance engineers who have Intel VTune Profiler, the oneAPI Toolkit, the System Bring-up Toolkit, SoC Watch or SEP installed on Windows or Linux workstations or build and test machines. An attacker needs local access with a normal account, so shared or multi-user machines matter most. Machines without these tools installed can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T17:26:26Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","run_id":2477},"products":{"at":"2026-11-10T17:26:26Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","run_id":2477},"how_to_check":{"at":"2026-11-10T17:26:26Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","run_id":2477},"who_affected":{"at":"2026-11-10T17:26:26Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","run_id":2477}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["enablingproductsep","inteloneapitoolkit","intelsocwatch","intelsystembringuptoolkit","intelvtuneprofiler","oneapitoolkit","samplingenablingproductsep","socwatch","systembringuptoolkit","vtuneprofiler"],"ptokens":["bring","enabling","intel","oneapi","product","profiler","sampling","sep","soc","system","toolkit","up","vtune","watch"],"labels":["high","infrastructure","intel","linux","localprivilegeescalation","oneapi","vtune","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-32667':17A,20A 'bound':7A 'bring':30A 'bring-up':29A 'cve':15A,18A 'devic':10A 'driver':11A 'enabl':12A 'enabling':37A 'escal':14A 'intel':1A,21A,24A,27A,33A 'oneapi':25A 'out-of-bound':4A 'privileg':13A 'product':38A 'profil':3A 'profiler':23A 'sampling':36A 'sep':39A 'soc':34A 'system':28A 'toolkit':26A,32A 'up':31A 'vtune':2A,22A 'watch':35A 'write':8A","search_b":"'01477':99B '1':55B '2026.0.0':109B,113B,120B '2026.1':124B '4.0':77B '5.58':128B '8.5':78B 'advisori':95B 'affect':103B 'avail':86B 'bound':64B 'bring':116B 'bring-up':115B 'compon':58B 'confidenti':83B 'cves':92B 'cvss':76B 'devic':56B 'driver':57B 'escal':46B,74B 'high':79B,80B 'impact':81B 'infrastructur':40B 'integr':84B 'intel':41B,50B,94B,97B,100B 'intel-sa':96B 'let':67B 'linux':42B 'list':101B 'local':44B,69B 'local-privilege-escal':43B 'low':71B 'low-privileg':70B 'nine':91B 'one':89B 'oneapi':47B,110B 'out-of-bound':61B 'privileg':45B,72B,75B 'product':104B 'profil':52B,107B 'ring':54B 'sa':98B 'sep':126B 'soc':121B 'system':114B 'toolkit':111B,118B 'user':73B 'vtune':48B,51B,106B 'watch':122B 'window':49B 'write':65B","search_c":"'1':144C 'access':178C 'adversari':155C 'allow':148C 'attack':165C,180C 'authent':158C 'avail':205C,220C 'bound':132C 'combin':160C 'complex':164C 'confidenti':200C,215C 'devic':145C 'driver':146C 'enabl':167C 'escal':150C,168C 'high':201C,203C,206C 'impact':198C,222C 'integr':202C,217C 'intel':136C 'interact':193C 'intern':187C 'knowledg':188C 'local':177C 'low':163C 'may':147C,166C,173C,197C 'none':216C,218C,221C 'occur':175C 'out-of-bound':129C 'potenti':174C,195C 'present':184C 'privileg':152C,170C 'profil':140C 'r':137C 'requir':181C,190C 'result':172C,211C 'ring':143C 'softwar':141C,154C 'special':186C 'subsequ':213C 'system':210C,214C 'tm':139C 'unprivileg':153C 'user':159C,192C 'via':176C 'vtune':138C 'vulner':196C,209C 'within':142C 'without':185C 'write':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-32667","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32667","severity":null,"published_at":"2026-11-10T17:17:40+00:00","modified_at":"2026-11-10T17:17:40+00:00","first_seen_at":"2026-11-10T17:22:42+00:00","fetched_at":"2026-11-10T17:22:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-32667:2477","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","severity":null,"published_at":"2026-11-10T17:26:26+00:00","modified_at":"2026-11-10T17:26:26+00:00","first_seen_at":"2026-11-10T17:26:26+00:00","fetched_at":"2026-11-10T17:26:26+00:00","note":"Read Intel INTEL-SA-01477 (released 2026-11-10). CVE-2026-32667 is an OOB write in the Ring 1 device drivers; CVSS 4.0 8.5 High, local, low privileges. The advisory covers 9 CVEs. Its affected-products list gives versions, but the per-CVE text for this CVE has no version line. No exploitation or PoC found in the advisory; I did not search social posts.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html"]}],"documents":[{"id":116636,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","title":"INTEL-SA-01477 Intel VTune Profiler Software Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}