CVE-2026-20786

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in Intel NPU Driver

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: Intel Corporation

Description

Out-of-bounds read for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-20786

EUVD

EUVD-2026-56499

Affected Vendors & Products

Vendor	Product	Version / Range
intel	npu_driver	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out-of-bounds read vulnerability in the Intel NPU Driver affecting all versions. It allows a denial of service via local access by an unprivileged, authenticated attacker with low complexity. No special internal knowledge or user interaction is required.

Detection Guidance

Detection requires monitoring for abnormal system behavior or crashes related to the Intel NPU Driver. Check for driver logs or system events indicating out-of-bounds access. No specific commands are provided in the context.

Impact Analysis

The vulnerability may cause a denial of service, impacting system availability. Confidentiality and integrity impacts are low or none, but availability is high. The system may become unresponsive or crash.

Compliance Impact

This vulnerability primarily impacts system availability due to a potential denial of service, which could disrupt services handling sensitive data. GDPR and HIPAA focus on data confidentiality and integrity; while this CVE does not directly expose data, prolonged downtime could affect compliance by preventing timely access to required records or processing capabilities.

Mitigation Strategies

Update the Intel NPU Driver to the latest version as soon as patches are available. Restrict local access to unprivileged users and monitor for suspicious activity. Disable the driver if not essential.

Hi! I’m here to help you understand CVE-2026-20786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70