CVE-2025-32091 Overview
CVE-2025-32091 affects firmware for Intel Arc B-series GPUs. The vulnerability stems from incorrect default permissions within Ring 1 device drivers. A privileged local user can exploit these permissions to escalate privileges on the affected system. The flaw is classified under [CWE-276] Incorrect Default Permissions.
Exploitation requires local access and existing privileged user context. The attack complexity is low and requires no user interaction. Successful exploitation impacts confidentiality, integrity, and availability of the affected system.
Critical Impact
A local adversary with privileged access can achieve full escalation of privilege on systems using vulnerable Intel Arc B-series GPU firmware, resulting in high impact to confidentiality, integrity, and availability.
Affected Products
- Intel Arc B-series GPU firmware (Ring 1: Device Drivers)
- Systems integrating vulnerable Intel Arc B-series GPU firmware
- Refer to Intel Security Advisory SA-01356 for the exact affected firmware versions
Discovery Timeline
- 2025-11-11 - CVE-2025-32091 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32091
Vulnerability Analysis
The vulnerability resides in firmware for the Intel Arc B-series discrete GPUs. Firmware components executing within Ring 1 (Device Drivers) ship with incorrect default permissions. This misconfiguration allows an already privileged system software adversary to perform actions beyond their intended authorization boundary.
Ring 1 is an intermediate CPU privilege level historically reserved for device drivers on x86 architectures. Firmware operating at this ring interacts closely with kernel-mode components and hardware interfaces. When permissions are configured too loosely at this layer, they weaken the trust boundary between the operating system and the GPU firmware.
The issue does not require special internal knowledge and does not depend on additional attack requirements. Impact is contained to the vulnerable system, with no subsequent impact propagation to other components per the CVSS scope indicators.
Root Cause
The root cause is a permission-model defect [CWE-276] in the shipping firmware for Intel Arc B-series GPUs. Access control on firmware-exposed interfaces or resources is more permissive than required. A local privileged actor can leverage these permissions to reach code paths or resources that should be restricted, enabling privilege escalation.
Attack Vector
Exploitation requires local access to the target system and an existing high-privilege user context. The attacker interacts with the GPU firmware interface through the device driver stack. Because attack complexity is low and no user interaction is required, an attacker with a foothold and elevated privileges can trigger the escalation deterministically.
No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation is available at the time of writing. The EPSS probability is 0.129%, reflecting low near-term exploitation likelihood.
No verified exploit code has been published. Refer to the Intel Security Advisory SA-01356 for authoritative technical details.
Detection Methods for CVE-2025-32091
Indicators of Compromise
- No public indicators of compromise have been published for CVE-2025-32091.
- Monitor for unexpected GPU firmware interactions or driver-level anomalies on systems using Intel Arc B-series GPUs.
- Investigate unexplained privilege escalations on hosts with the affected hardware.
Detection Strategies
- Inventory endpoints and workstations containing Intel Arc B-series GPUs and enumerate their firmware versions.
- Correlate local privilege escalation alerts with the presence of vulnerable GPU firmware.
- Track loading of GPU driver components and any process attempting non-standard IOCTL interactions with the GPU.
Monitoring Recommendations
- Enable endpoint telemetry that captures driver load events, kernel object access, and privilege transitions.
- Alert on newly created privileged processes spawned by user-mode components interacting with the GPU driver.
- Retain firmware version data in configuration management systems to detect regressions after patching.
How to Mitigate CVE-2025-32091
Immediate Actions Required
- Identify all systems with Intel Arc B-series GPUs across the environment.
- Apply the firmware update referenced in Intel Security Advisory SA-01356 as soon as it is available for your platform.
- Restrict local administrative access on affected systems until firmware remediation is complete.
- Audit privileged account usage on workstations and servers that host the affected hardware.
Patch Information
Intel has published Intel Security Advisory SA-01356 covering this issue. Consult the advisory for the fixed firmware versions and the OEM update channels that distribute the corrected firmware for Intel Arc B-series GPUs.
Workarounds
- Limit the number of accounts holding local administrator or equivalent privileges on affected hosts.
- Enforce least privilege for accounts that manage GPU drivers or perform GPU-accelerated workloads.
- Where operationally feasible, disable or remove the affected GPU on systems that cannot be patched immediately.
- Segment high-value systems containing the affected hardware from general-purpose user access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
