CVE-2026-20717: Intel QuickAssist Technology DoS Vulnerability

CVE-2026-20717 Overview

CVE-2026-20717 is an improper input validation vulnerability [CWE-20] affecting Intel QuickAssist Technology (QAT) software drivers for Windows before version 1.13. The flaw resides in Ring 3 user-mode application components and can be triggered by an authenticated local user. Successful exploitation enables a denial of service condition on the affected host.

Intel published advisory Intel-SA-01387 documenting the issue. The vulnerability carries a CVSS 4.0 score of 6.9 with attack vector Local and low attack complexity. No public exploit code or in-the-wild exploitation has been reported.

Critical Impact

An authenticated local attacker can crash or destabilize systems running vulnerable Intel QAT drivers on Windows, producing a high availability impact on the affected host.

Affected Products

• Intel QuickAssist Technology (QAT) software drivers for Windows before version 1.13
• Windows systems leveraging Intel QAT for cryptographic and compression acceleration
• Server and workstation deployments depending on QAT user-mode libraries

Discovery Timeline

• 2026-05-12 - CVE CVE-2026-20717 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-20717

Vulnerability Analysis

The vulnerability stems from improper input validation within Intel QAT software drivers operating at Ring 3 (user-mode applications). When user-supplied input reaches affected driver components, the software fails to enforce validation constraints on the data before processing it. This permits an authenticated local user to submit malformed input that disrupts driver execution.

The primary consequence is denial of service. Confidentiality and integrity impacts are limited, while availability impact on the vulnerable system is high. Subsequent system impacts are none, meaning the failure is contained to the affected component rather than cascading to dependent services.

Exploitation requires local access and an authenticated session. No special internal knowledge of the target is required, and no user interaction is needed beyond the attacker's own actions. The attack complexity is low, which simplifies reliable exploitation for any user with shell or process-level access to the host.

Root Cause

The root cause is missing or insufficient input validation logic in QAT user-mode driver code paths. Inputs that fall outside expected ranges or formats are processed without rejection, leading to an unhandled state that terminates or hangs driver operations.

Attack Vector

An attacker with valid credentials on the target Windows host invokes QAT driver interfaces from user-mode code. The attacker supplies crafted parameters to a vulnerable driver entry point. The driver consumes the input without validating bounds or structure, producing a failure that denies service to legitimate consumers of QAT acceleration.

No verified public proof-of-concept code exists for this issue. Refer to the Intel Security Advisory SA-01387 for vendor technical detail.

Detection Methods for CVE-2026-20717

Indicators of Compromise

• Unexpected termination, hangs, or restarts of Intel QAT user-mode services and processes on Windows hosts
• Windows Event Log entries showing repeated faults in QAT driver components or dependent cryptographic services
• Sudden loss of QAT acceleration causing fallback to software cryptography and elevated CPU utilization

Detection Strategies

• Inventory hosts with Intel QAT driver versions below 1.13 using software asset management and endpoint telemetry
• Correlate local user process activity with QAT driver crash events to identify suspicious invocation patterns
• Alert on non-administrative processes interacting with QAT driver interfaces outside expected application workflows

Monitoring Recommendations

• Forward Windows System and Application event logs to a centralized SIEM for analysis of driver fault signatures
• Track QAT service availability and restart counts as a service health metric
• Monitor for repeated authentication followed by driver crash sequences from the same user context

How to Mitigate CVE-2026-20717

Immediate Actions Required

• Update Intel QAT software drivers for Windows to version 1.13 or later on all affected hosts
• Restrict interactive and remote local logon rights to trusted administrators where feasible
• Audit application dependencies on QAT acceleration to plan controlled patching windows

Patch Information

Intel addressed the vulnerability in QAT software drivers for Windows version 1.13. Download the updated driver package and follow installation guidance from the Intel Security Advisory SA-01387. Validate driver version after installation to confirm remediation.

Workarounds

• Limit local logon to the minimum set of authenticated users required for operations
• Disable QAT driver functionality on hosts where acceleration is not required until patching completes
• Apply application allowlisting to prevent untrusted user-mode binaries from invoking QAT interfaces

# Verify installed Intel QAT driver version on Windows (PowerShell)
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*QuickAssist*" } | Select-Object DeviceName, DriverVersion