{"id":"CVE-2026-34016","kind":"vulnerability","aliases":["CVE-2026-34016"],"related":[],"title":"Intel VTune Profiler: race condition lets local user gain system privileges","description":"Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"Intel VTune Profiler before version 2026.0.0 has a time-of-check time-of-use race condition in its Ring 1 device driver component. A local user with an ordinary account can win the race and escalate privileges, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["intel-vtune","linux","other","windows"],"not_affected_if":["fixed-version","not-installed"],"how_to_check":"- Check the installed VTune Profiler version in the product's about screen or install directory, and compare it with `2026.0.0`.","fix":"- Intel VTune Profiler: move to `2026.0.0` or later.","status":"open","published_at":"2026-11-10T17:17:41+00:00","first_seen_at":"2026-11-10T17:22:42+00:00","triaged_at":"2026-11-10T17:23:51+00:00","updated_at":"2026-11-10T17:23:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T17:23:51Z","model":"claude-haiku-5-5","output":{"fix":"- Intel VTune Profiler: move to `2026.0.0` or later.","reach":"local","title":"Intel VTune Profiler: race condition lets local user gain system privileges","impact":"high","summary":"Intel VTune Profiler before version 2026.0.0 has a time-of-check time-of-use race condition in its Ring 1 device driver component. A local user with an ordinary account can win the race and escalate privileges, with high impact to confidentiality, integrity and availability.","audience":"businesses","category":"other","nicknames":[],"who_cares":["intel-vtune","windows","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"local user gains full system privileges through the driver","analyst_note":"","how_to_check":"- Check the installed VTune Profiler version in the product's about screen or install directory, and compare it with `2026.0.0`.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-installed","fixed-version"],"who_is_affected":"Systems where Intel VTune Profiler is installed before version 2026.0.0 are exposed, and the attacker needs a local, authenticated account on that machine. Machines without VTune Profiler installed, or already on 2026.0.0 or later, can skip it. The sources do not say whether the flaw is reachable from outside the machine.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4679,"output_tokens":519,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-34016':14A,17A '1':45B,94C '2026.0.0':29B,91C 'access':128C 'account':55B 'adversari':105C 'allow':98C 'attack':115C,130C 'authent':108C 'avail':70B,155C,170C 'check':35B,74C 'combin':110C 'complex':114C 'compon':48B 'condit':5A,41B,80C 'confidenti':67B,150C,165C 'cve':12A,15A 'devic':46B,95C 'driver':47B,96C 'enabl':117C 'escal':61B,100C,118C 'gain':9A 'high':64B,151C,153C,156C 'impact':65B,148C,172C 'integr':68B,152C,167C 'intel':1A,19B,24B,83C 'intel-vtun':18B 'interact':143C 'intern':137C 'knowledg':138C 'let':6A 'linux':21B 'local':7A,50B,127C 'low':113C 'may':97C,116C,123C,147C 'none':166C,168C,171C 'occur':125C 'ordinari':54B 'potenti':124C,145C 'present':134C 'privileg':11A,62B,102C,120C 'profil':3A,26B,87C 'r':84C 'race':4A,40B,59B,79C 'requir':131C,140C 'result':122C,161C 'ring':44B,93C 'softwar':88C,104C 'special':136C 'subsequ':163C 'system':10A,160C,164C 'time':33B,37B,72C,76C 'time-of-check':32B,71C 'time-of-us':36B,75C 'tm':86C 'unprivileg':103C 'use':39B,78C 'user':8A,51B,109C,142C 'version':28B,90C 'via':126C 'vtune':2A,20B,25B,85C 'vulner':146C,159C 'win':57B 'window':23B 'within':92C 'without':135C","nicknames":[],"mitigations":[],"who_affected":"Systems where Intel VTune Profiler is installed before version 2026.0.0 are exposed, and the attacker needs a local, authenticated account on that machine. Machines without VTune Profiler installed, or already on 2026.0.0 or later, can skip it. The sources do not say whether the flaw is reachable from outside the machine.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","intelvtune","linux","other","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-34016':14A,17A 'condit':5A 'cve':12A,15A 'gain':9A 'intel':1A 'let':6A 'local':7A 'privileg':11A 'profil':3A 'race':4A 'system':10A 'user':8A 'vtune':2A","search_b":"'1':45B '2026.0.0':29B 'account':55B 'avail':70B 'check':35B 'compon':48B 'condit':41B 'confidenti':67B 'devic':46B 'driver':47B 'escal':61B 'high':64B 'impact':65B 'integr':68B 'intel':19B,24B 'intel-vtun':18B 'linux':21B 'local':50B 'ordinari':54B 'privileg':62B 'profil':26B 'race':40B,59B 'ring':44B 'time':33B,37B 'time-of-check':32B 'time-of-us':36B 'use':39B 'user':51B 'version':28B 'vtune':20B,25B 'win':57B 'window':23B","search_c":"'1':94C '2026.0.0':91C 'access':128C 'adversari':105C 'allow':98C 'attack':115C,130C 'authent':108C 'avail':155C,170C 'check':74C 'combin':110C 'complex':114C 'condit':80C 'confidenti':150C,165C 'devic':95C 'driver':96C 'enabl':117C 'escal':100C,118C 'high':151C,153C,156C 'impact':148C,172C 'integr':152C,167C 'intel':83C 'interact':143C 'intern':137C 'knowledg':138C 'local':127C 'low':113C 'may':97C,116C,123C,147C 'none':166C,168C,171C 'occur':125C 'potenti':124C,145C 'present':134C 'privileg':102C,120C 'profil':87C 'r':84C 'race':79C 'requir':131C,140C 'result':122C,161C 'ring':93C 'softwar':88C,104C 'special':136C 'subsequ':163C 'system':160C,164C 'time':72C,76C 'time-of-check':71C 'time-of-us':75C 'tm':86C 'unprivileg':103C 'use':78C 'user':109C,142C 'version':90C 'via':126C 'vtune':85C 'vulner':146C,159C 'within':92C 'without':135C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-34016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34016","severity":null,"published_at":"2026-11-10T17:17:41+00:00","modified_at":"2026-11-10T17:17:41+00:00","first_seen_at":"2026-11-10T17:22:42+00:00","fetched_at":"2026-11-10T17:22:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}