{"id":"CVE-2026-32670","kind":"vulnerability","aliases":["CVE-2026-32670"],"related":[],"title":"Intel VTune Profiler: local race condition lets a user gain system privileges","description":"Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"Intel VTune Profiler's Ring 1 device driver has a time-of-check time-of-use race condition (CVE-2026-32670, CVSS 4.0 8.5 High). A local, authenticated low-privilege user can escalate privileges. Fixed in VTune Profiler 2026.0.0 (INTEL-SA-01477).","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Intel VTune Profiler","fixed":["2026.0.0"],"affected":"< 2026.0.0","ecosystem":"vendor"},{"name":"Intel oneAPI Toolkit","fixed":["2026.0.0"],"affected":"< 2026.0.0","ecosystem":"vendor"},{"name":"Intel System Bring-up Toolkit","fixed":["2026.0.0"],"affected":"< 2026.0.0","ecosystem":"vendor"},{"name":"Intel SoC Watch","fixed":["2026.1"],"affected":"< 2026.1","ecosystem":"vendor"},{"name":"Sampling Enabling Product (SEP)","fixed":["5.58"],"affected":"< 5.58","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","intel-oneapi","intel-vtune","linux","local-privilege-escalation","windows"],"not_affected_if":["no-local-untrusted-users","vtune-not-installed"],"how_to_check":"Check the installed VTune Profiler version (also bundled in the Intel oneAPI Toolkit and System Bring-up Toolkit); versions before 2026.0.0 are in Intel's affected list. Also check Intel SoC Watch (before 2026.1) and Sampling Enabling Product/SEP (before 5.58), which Intel lists as affected. Intel's advisory does not state which operating systems are covered.","fix":"Update Intel VTune Profiler to 2026.0.0 or later (includes SoC Watch 2026.1+ and SEP 5.58+). oneAPI Toolkit and System Bring-up Toolkit: 2026.0.0 or later.","status":"open","published_at":"2026-11-10T17:17:40+00:00","first_seen_at":"2026-11-10T17:22:42+00:00","triaged_at":"2026-11-10T17:23:54+00:00","updated_at":"2026-11-10T17:25:10+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T17:23:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel VTune Profiler: local race condition lets a user gain system privileges","impact":"high","summary":"Intel VTune Profiler's Ring 1 device driver component has a time-of-check time-of-use race condition. A logged-in local user with low privileges can exploit it to escalate privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel-vtune","windows","linux","local-privilege-escalation"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains full system control with high confidentiality and integrity impact","analyst_note":"Find Intel's security advisory for VTune and confirm affected and fixed versions and the platforms covered.","how_to_check":"- Check whether Intel VTune Profiler is installed on the machine, including its device driver components.\n- Confirm the installed version against the fixed versions listed in Intel's advisory; the sources here do not name them.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["vtune-not-installed","no-local-untrusted-users"],"who_is_affected":"Machines where Intel VTune Profiler and its Ring 1 device drivers are installed, such as developer and performance-testing workstations and servers. The attack requires a local authenticated account, so systems with no VTune installation or only trusted single users carry less risk. unknown for the exact affected version range.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":4671,"output_tokens":541,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Intel's security advisory for VTune and confirm affected and fixed versions and the platforms covered.","search":"'-2026':14A,17A,72B '-32670':15A,18A,73B '01477':96B '1':56B,117C '2026.0.0':92B '4.0':75B '8.5':76B 'access':151C 'adversari':128C 'allow':121C 'attack':138C,153C 'authent':80B,131C 'avail':178C,193C 'bring':28A 'bring-up':27A 'check':64B,100C 'combin':133C 'complex':137C 'condit':6A,70B,106C 'confidenti':173C,188C 'cve':13A,16A,71B 'cvss':74B 'devic':57B,118C 'driver':58B,119C 'enabl':140C 'enabling':35A 'escal':49B,86B,123C,141C 'fix':88B 'gain':10A 'high':77B,174C,176C,179C 'impact':171C,195C 'infrastructur':38B 'integr':175C,190C 'intel':1A,19A,22A,25A,31A,40B,43B,51B,94B,109C 'intel-oneapi':39B 'intel-sa':93B 'intel-vtun':42B 'interact':166C 'intern':160C 'knowledg':161C 'let':7A 'linux':45B 'local':4A,47B,79B,150C 'local-privilege-escal':46B 'low':82B,136C 'low-privileg':81B 'may':120C,139C,146C,170C 'none':189C,191C,194C 'occur':148C 'oneapi':23A,41B 'potenti':147C,168C 'present':157C 'privileg':12A,48B,83B,87B,125C,143C 'product':36A 'profil':3A,53B,91B,113C 'profiler':21A 'r':110C 'race':5A,69B,105C 'requir':154C,163C 'result':145C,184C 'ring':55B,116C 'sa':95B 'sampling':34A 'sep':37A 'soc':32A 'softwar':114C,127C 'special':159C 'subsequ':186C 'system':11A,26A,183C,187C 'time':62B,66B,98C,102C 'time-of-check':61B,97C 'time-of-us':65B,101C 'tm':112C 'toolkit':24A,30A 'unprivileg':126C 'up':29A 'use':68B,104C 'user':9A,84B,132C,165C 'via':149C 'vtune':2A,20A,44B,52B,90B,111C 'vulner':169C,182C 'watch':33A 'window':50B 'within':115C 'without':158C","nicknames":[],"mitigations":[],"who_affected":"Machines where Intel VTune Profiler before 2026.0.0 is installed, including copies bundled in the Intel oneAPI Toolkit or System Bring-up Toolkit before 2026.0.0, SoC Watch before 2026.1, or SEP before 5.58. An attacker needs local access with a low-privilege account. Systems without these tools can skip it; shared developer workstations and build or profiling hosts matter most.","tier":"B","verified":{"fix":{"at":"2026-11-10T17:25:10Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","run_id":2476},"products":{"at":"2026-11-10T17:25:10Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","run_id":2476},"how_to_check":{"at":"2026-11-10T17:25:10Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","run_id":2476},"who_affected":{"at":"2026-11-10T17:25:10Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","run_id":2476}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["enablingproductsep","inteloneapitoolkit","intelsocwatch","intelsystembringuptoolkit","intelvtuneprofiler","oneapitoolkit","samplingenablingproductsep","socwatch","systembringuptoolkit","vtuneprofiler"],"ptokens":["bring","enabling","intel","oneapi","product","profiler","sampling","sep","soc","system","toolkit","up","vtune","watch"],"labels":["high","infrastructure","inteloneapi","intelvtune","linux","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-32670':15A,18A 'bring':28A 'bring-up':27A 'condit':6A 'cve':13A,16A 'enabling':35A 'gain':10A 'intel':1A,19A,22A,25A,31A 'let':7A 'local':4A 'oneapi':23A 'privileg':12A 'product':36A 'profil':3A 'profiler':21A 'race':5A 'sampling':34A 'sep':37A 'soc':32A 'system':11A,26A 'toolkit':24A,30A 'up':29A 'user':9A 'vtune':2A,20A 'watch':33A","search_b":"'-2026':72B '-32670':73B '01477':96B '1':56B '2026.0.0':92B '4.0':75B '8.5':76B 'authent':80B 'check':64B 'condit':70B 'cve':71B 'cvss':74B 'devic':57B 'driver':58B 'escal':49B,86B 'fix':88B 'high':77B 'infrastructur':38B 'intel':40B,43B,51B,94B 'intel-oneapi':39B 'intel-sa':93B 'intel-vtun':42B 'linux':45B 'local':47B,79B 'local-privilege-escal':46B 'low':82B 'low-privileg':81B 'oneapi':41B 'privileg':48B,83B,87B 'profil':53B,91B 'race':69B 'ring':55B 'sa':95B 'time':62B,66B 'time-of-check':61B 'time-of-us':65B 'use':68B 'user':84B 'vtune':44B,52B,90B 'window':50B","search_c":"'1':117C 'access':151C 'adversari':128C 'allow':121C 'attack':138C,153C 'authent':131C 'avail':178C,193C 'check':100C 'combin':133C 'complex':137C 'condit':106C 'confidenti':173C,188C 'devic':118C 'driver':119C 'enabl':140C 'escal':123C,141C 'high':174C,176C,179C 'impact':171C,195C 'integr':175C,190C 'intel':109C 'interact':166C 'intern':160C 'knowledg':161C 'local':150C 'low':136C 'may':120C,139C,146C,170C 'none':189C,191C,194C 'occur':148C 'potenti':147C,168C 'present':157C 'privileg':125C,143C 'profil':113C 'r':110C 'race':105C 'requir':154C,163C 'result':145C,184C 'ring':116C 'softwar':114C,127C 'special':159C 'subsequ':186C 'system':183C,187C 'time':98C,102C 'time-of-check':97C 'time-of-us':101C 'tm':112C 'unprivileg':126C 'use':104C 'user':132C,165C 'via':149C 'vtune':111C 'vulner':169C,182C 'within':115C 'without':158C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-32670","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32670","severity":null,"published_at":"2026-11-10T17:17:40+00:00","modified_at":"2026-11-10T17:17:40+00:00","first_seen_at":"2026-11-10T17:22:42+00:00","fetched_at":"2026-11-10T17:22:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-32670:2476","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","severity":null,"published_at":"2026-11-10T17:25:10+00:00","modified_at":"2026-11-10T17:25:10+00:00","first_seen_at":"2026-11-10T17:25:10+00:00","fetched_at":"2026-11-10T17:25:10+00:00","note":"Read Intel INTEL-SA-01477 (released 2026-11-10, 9 CVEs). Fix is advisory-wide: VTune 2026.0.0+; the CVE-2026-32670 entry itself has no per-CVE version line. Advisory does not name platforms (Windows/Linux not stated), so dropped those tags; no exploitation or PoC mentioned. Did not search X.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html"]}],"documents":[{"id":116636,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html","title":"INTEL-SA-01477 Intel VTune Profiler Software Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}