CVE-2026-20731

Analyzed Analyzed - Analysis Complete

Denial of Service in Intel NPU Driver

Publication date: 2026-08-11

Last updated on: 2026-08-31

Assigner: Intel Corporation

Description

Improper buffer restrictions for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-20731

EUVD

EUVD-2026-56479

Affected Vendors & Products

Vendor	Product	Version / Range
intel	neural_processing_unit_driver	to 1.32.0 (exc)
intel	neural_processing_unit_driver	to 32.0.100.4723 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in the Intel NPU Driver. It allows an unauthenticated local attacker with low complexity to crash the system without special knowledge or user interaction. The attack exploits improper buffer restrictions in Ring 3 user applications.

Detection Guidance

This vulnerability cannot be directly detected with specific commands as the provided CVE details do not include detection methods or tools. The issue involves improper buffer restrictions in the Intel NPU Driver, which may lead to a denial of service. Monitoring for system crashes or unusual behavior in applications using the NPU driver could be a manual approach.

Impact Analysis

An attacker could exploit this to cause a system crash or freeze, leading to loss of availability. Since it requires local access but no special privileges, any authenticated user on the system could potentially trigger it.

Compliance Impact

This vulnerability primarily impacts system availability, which could lead to service disruptions. For GDPR, it may affect data processing integrity. For HIPAA, it could disrupt access to protected health information. Compliance may require patching to maintain required uptime and access controls.

Mitigation Strategies

Update the Intel NPU Driver to the latest version provided by Intel to address the improper buffer restrictions. Monitor Intel's security advisories for patches and apply them promptly. Restrict local access to untrusted users to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-20731. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70