---
id: "CVE-2026-32670"
page: "https://infrastack.ai/live/CVE-2026-32670"
kind: "vulnerability"
aliases: ["CVE-2026-32670"]
title: "Intel VTune Profiler: local race condition lets a user gain system privileges"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Intel VTune Profiler", "fixed": ["2026.0.0"], "affected": "< 2026.0.0", "ecosystem": "vendor"}, {"name": "Intel oneAPI Toolkit", "fixed": ["2026.0.0"], "affected": "< 2026.0.0", "ecosystem": "vendor"}, {"name": "Intel System Bring-up Toolkit", "fixed": ["2026.0.0"], "affected": "< 2026.0.0", "ecosystem": "vendor"}, {"name": "Intel SoC Watch", "fixed": ["2026.1"], "affected": "< 2026.1", "ecosystem": "vendor"}, {"name": "Sampling Enabling Product (SEP)", "fixed": ["5.58"], "affected": "< 5.58", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "intel-oneapi", "intel-vtune", "linux", "local-privilege-escalation", "windows"]
not_affected_if: ["no-local-untrusted-users", "vtune-not-installed"]
published_at: "2026-11-10T17:17:40+00:00"
first_seen_at: "2026-11-10T17:22:42+00:00"
updated_at: "2026-11-10T17:25:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32670", "first_seen_at": "2026-11-10T17:22:42+00:00"}, {"source": "analyst", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html", "first_seen_at": "2026-11-10T17:25:10+00:00", "cites": ["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html"]}]
exploit_sources: []
---

# Intel VTune Profiler: local race condition lets a user gain system privileges

Link for people: https://infrastack.ai/live/CVE-2026-32670 (this .md is for agents)

Intel VTune Profiler's Ring 1 device driver has a time-of-check time-of-use race condition (CVE-2026-32670, CVSS 4.0 8.5 High). A local, authenticated low-privilege user can escalate privileges. Fixed in VTune Profiler 2026.0.0 (INTEL-SA-01477).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Intel VTune Profiler affected < 2026.0.0 fixed 2026.0.0
- vendor:Intel oneAPI Toolkit affected < 2026.0.0 fixed 2026.0.0
- vendor:Intel System Bring-up Toolkit affected < 2026.0.0 fixed 2026.0.0
- vendor:Intel SoC Watch affected < 2026.1 fixed 2026.1
- vendor:Sampling Enabling Product (SEP) affected < 5.58 fixed 5.58

## How to check

Check the installed VTune Profiler version (also bundled in the Intel oneAPI Toolkit and System Bring-up Toolkit); versions before 2026.0.0 are in Intel's affected list. Also check Intel SoC Watch (before 2026.1) and Sampling Enabling Product/SEP (before 5.58), which Intel lists as affected. Intel's advisory does not state which operating systems are covered.

## Fix

Update Intel VTune Profiler to 2026.0.0 or later (includes SoC Watch 2026.1+ and SEP 5.58+). oneAPI Toolkit and System Bring-up Toolkit: 2026.0.0 or later.

## Timeline

- 2026-11-10T17:22:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-32670
- 2026-11-10T17:25:10+00:00 analyst https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html — Read Intel INTEL-SA-01477 (released 2026-11-10, 9 CVEs). Fix is advisory-wide: VTune 2026.0.0+; the CVE-2026-32670 entry itself has no per-CVE version line. Advisory does not name platforms (Windows/Linux not stated), so dropped those tags; no exploitation or PoC mentioned. Did not search X.

## Documents

- [advisory] INTEL-SA-01477 Intel VTune Profiler Software Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html

## From the sources

Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_