---
id: "CVE-2026-40065"
page: "https://infrastack.ai/live/CVE-2026-40065"
kind: "vulnerability"
aliases: ["CVE-2026-40065"]
title: "Intel Neural Compressor: input validation flaw allows local privilege escalation"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["intel-neural-compressor", "local-access", "package", "python"]
not_affected_if: ["no-local-untrusted-users", "version-3.7-or-later"]
published_at: "2026-11-10T17:17:42+00:00"
first_seen_at: "2026-11-10T17:22:43+00:00"
updated_at: "2026-11-10T17:24:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40065", "first_seen_at": "2026-11-10T17:22:43+00:00"}]
exploit_sources: []
---

# Intel Neural Compressor: input validation flaw allows local privilege escalation

Link for people: https://infrastack.ai/live/CVE-2026-40065 (this .md is for agents)

Intel Neural Compressor before v3.7 has an input validation flaw that lets an unprivileged local user escalate privileges. An attacker with local access can gain higher system rights, which could expose or change data on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Intel Neural Compressor version (for example `pip show neural-compressor`) and compare it with the fixed version.

## Fix

- Intel Neural Compressor: move to `v3.7` or later.

## Timeline

- 2026-11-10T17:22:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-40065

## From the sources

Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_