CVE-2025-14614: Quartus Prime Information Disclosure Flaw

CVE-2025-14614 Overview

An insecure temporary file vulnerability has been identified in the Altera Quartus Prime Standard and Lite Installer (SFX) packages for Windows. The vulnerability stems from the use of predictable temporary file names during the installation process, which could allow local attackers to exploit race conditions and potentially gain elevated privileges or manipulate installation files.

Critical Impact

Local attackers with limited privileges can potentially predict and preemptively create temporary files used by the installer, leading to possible file manipulation, code execution, or privilege escalation during installation.

Affected Products

• Altera Quartus Prime Standard Installer (SFX) versions 23.1 through 24.1 on Windows
• Altera Quartus Prime Lite Installer (SFX) versions 23.1 through 24.1 on Windows

Discovery Timeline

• 2026-01-07 - CVE-2025-14614 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-14614

Vulnerability Analysis

This vulnerability is classified under CWE-377 (Insecure Temporary File), which occurs when an application creates temporary files in an insecure manner. The Altera Quartus Prime installers for Windows fail to properly generate unique, unpredictable temporary file names during the installation process. This weakness enables local attackers to predict the names of temporary files that will be created, potentially allowing them to pre-create these files with malicious content or establish symbolic links to sensitive system files.

The attack requires local access and some user interaction, as the vulnerability can only be exploited during the installation process. However, successful exploitation could lead to high impacts on confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability lies in the installer's use of predictable naming conventions for temporary files. Instead of generating cryptographically random file names or using secure system APIs for temporary file creation, the installer uses patterns that can be anticipated by an attacker. This implementation flaw violates secure coding practices for temporary file handling on Windows systems.

Attack Vector

The attack requires local access to the target system. An attacker would need to:

1. Monitor or predict when a user initiates the Quartus Prime installation
2. Pre-create temporary files in the expected location with predictable names
3. Populate these files with malicious content or create symbolic links to sensitive files
4. Wait for the installer to interact with these pre-created files

The vulnerability could be exploited through symlink attacks where the attacker creates a symbolic link from the predictable temporary file path to a sensitive system file, potentially causing the installer to overwrite or modify critical system resources with elevated privileges.

Detection Methods for CVE-2025-14614

Indicators of Compromise

• Unexpected files or symbolic links present in the Windows temporary directories (%TEMP%, %TMP%) prior to Quartus Prime installation
• Unusual file system activity in temp directories during installation processes
• Presence of hardlinks or junction points in temporary locations pointing to system directories

Detection Strategies

• Monitor file creation events in Windows temporary directories for patterns matching Quartus Prime installer temporary files
• Implement file integrity monitoring on critical system files during software installation procedures
• Use endpoint detection solutions to identify suspicious symlink or junction point creation in temp directories

Monitoring Recommendations

• Enable Windows Security Event logging for file system operations in temporary directories
• Deploy SentinelOne agents to detect and alert on suspicious file system manipulation during installation activities
• Implement application whitelisting policies that monitor for unexpected file creations during known installer execution

How to Mitigate CVE-2025-14614

Immediate Actions Required

• Avoid running Quartus Prime Standard or Lite installers (versions 23.1 through 24.1) on shared or multi-user Windows systems until patched
• Ensure that only trusted administrators with exclusive system access perform installations
• Clear and monitor temporary directories immediately before initiating the installation process
• Verify file system integrity after installation completes

Patch Information

Altera has released a security advisory addressing this vulnerability. Users should consult the Altera Security Advisory ASA-0005 for detailed patch information and updated installer downloads. It is recommended to upgrade to the latest version of Quartus Prime that includes the fix for predictable temporary file handling.

Workarounds

• Perform installations on isolated systems where other users cannot access the temporary file directories
• Create a dedicated, access-restricted temporary directory and configure the installer to use it via environment variables
• Monitor the temporary directory in real-time during installation and terminate the process if unexpected files appear

# Workaround: Create a secure temporary directory for installation
mkdir C:\SecureTemp
icacls C:\SecureTemp /inheritance:r /grant:r "%USERNAME%:(OI)(CI)F"
set TEMP=C:\SecureTemp
set TMP=C:\SecureTemp
# Run the Quartus Prime installer after setting these environment variables