CVE-2026-40065 · Package
NO FIX YET · SEE WHAT TO DO
Intel Neural Compressor before v3.7 has an input validation flaw that lets an unprivileged local user escalate privileges. An attacker with local access can gain higher system rights, which could expose or change data on the machine.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems where Intel Neural Compressor before v3.7 is installed and local users without privileges can run code. The sources do not describe a remote or default-config trigger, so machines without local untrusted users are lower risk.
Not affected if no-local-untrusted-users, version-3.7-or-later
Who cares intel-neural-compressor, local-access, python
pip show neural-compressor) and compare it with the fixed version.v3.7 or later.Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.