---
id: "CVE-2026-32667"
page: "https://infrastack.ai/live/CVE-2026-32667"
kind: "vulnerability"
aliases: ["CVE-2026-32667"]
title: "Intel VTune Profiler: out-of-bounds write in device drivers enables privilege escalation"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Intel VTune Profiler", "fixed": ["2026.0.0"], "affected": "< 2026.0.0", "ecosystem": "vendor"}, {"name": "Intel oneAPI Toolkit", "fixed": ["2026.0.0"], "affected": "< 2026.0.0", "ecosystem": "vendor"}, {"name": "Intel System Bring-up Toolkit", "fixed": ["2026.0.0"], "affected": "< 2026.0.0", "ecosystem": "vendor"}, {"name": "Intel SoC Watch", "fixed": ["2026.1"], "affected": "< 2026.1", "ecosystem": "vendor"}, {"name": "Sampling Enabling Product (SEP)", "fixed": ["5.58"], "affected": "< 5.58", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "intel", "linux", "local-privilege-escalation", "oneapi", "vtune", "windows"]
not_affected_if: ["not-installed", "vtune-2026.0.0-or-later", "vtune-not-installed"]
published_at: "2026-11-10T17:17:40+00:00"
first_seen_at: "2026-11-10T17:22:42+00:00"
updated_at: "2026-11-10T17:26:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32667", "first_seen_at": "2026-11-10T17:22:42+00:00"}, {"source": "analyst", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html", "first_seen_at": "2026-11-10T17:26:26+00:00", "cites": ["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html"]}]
exploit_sources: []
---

# Intel VTune Profiler: out-of-bounds write in device drivers enables privilege escalation

Link for people: https://infrastack.ai/live/CVE-2026-32667 (this .md is for agents)

Intel VTune Profiler's Ring 1 device driver component has an out-of-bounds write that lets a local, low-privileged user escalate privileges (CVSS 4.0 8.5 High, high impact on confidentiality, integrity and availability). It is one of nine CVEs in Intel advisory INTEL-SA-01477. Intel lists the affected products as VTune Profiler before 2026.0.0, oneAPI Toolkit before 2026.0.0, System Bring-up Toolkit before 2026.0.0, SoC Watch before 2026.1 and SEP before 5.58.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Intel VTune Profiler affected < 2026.0.0 fixed 2026.0.0
- vendor:Intel oneAPI Toolkit affected < 2026.0.0 fixed 2026.0.0
- vendor:Intel System Bring-up Toolkit affected < 2026.0.0 fixed 2026.0.0
- vendor:Intel SoC Watch affected < 2026.1 fixed 2026.1
- vendor:Sampling Enabling Product (SEP) affected < 5.58 fixed 5.58

## How to check

Find VTune Profiler, oneAPI Toolkit, System Bring-up Toolkit, SoC Watch or SEP (the sep drivers) on the machine and check their versions. Anything older than VTune/oneAPI/Bring-up 2026.0.0, SoC Watch 2026.1 or SEP 5.58 is in Intel's affected list. Intel's advisory does not name the driver files.

## Fix

Update Intel VTune Profiler to 2026.0.0 or later. That release includes SoC Watch 2026.1 or later and SEP 5.58 or later. Update oneAPI Toolkit and System Bring-up Toolkit to 2026.0.0 or later.

## Timeline

- 2026-11-10T17:22:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-32667
- 2026-11-10T17:26:26+00:00 analyst https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html — Read Intel INTEL-SA-01477 (released 2026-11-10). CVE-2026-32667 is an OOB write in the Ring 1 device drivers; CVSS 4.0 8.5 High, local, low privileges. The advisory covers 9 CVEs. Its affected-products list gives versions, but the per-CVE text for this CVE has no version line. No exploitation or PoC found in the advisory; I did not search social posts.

## Documents

- [advisory] INTEL-SA-01477 Intel VTune Profiler Software Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html

## From the sources

Out-of-bounds write for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_