CVE-2026-20771: Intel QAT Windows Driver DoS Vulnerability

CVE-2026-20771 Overview

CVE-2026-20771 is a null pointer dereference vulnerability [CWE-476] affecting Intel QuickAssist Technology (QAT) software drivers for Windows prior to version 1.13. The flaw resides within Ring 3 user-application space and can be triggered by an authenticated local user without special privileges or user interaction. Successful exploitation enables a denial-of-service condition against the host running the vulnerable driver. Intel disclosed the issue in security advisory INTEL-SA-01387 and released driver version 1.13 to address the defect.

Critical Impact
An authenticated local attacker can trigger a null pointer dereference in the Intel QAT Windows driver, causing a denial of service with high availability impact and low confidentiality impact on the affected component.

Affected Products

Intel QuickAssist Technology (QAT) software drivers for Windows before version 1.13
Windows hosts using Intel QAT acceleration in user-space (Ring 3) applications
Systems running cryptographic or compression workloads offloaded to Intel QAT

Discovery Timeline

2026-05-12 - CVE-2026-20771 published to NVD
2026-05-12 - Intel publishes security advisory INTEL-SA-01387
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-20771

Vulnerability Analysis

The vulnerability is a null pointer dereference within the Intel QAT software driver components reachable from Ring 3 user applications. When an unprivileged but authenticated process interacts with the driver in an unexpected state, the driver dereferences a pointer that has not been validated against NULL. This causes the affected driver thread or component to fault, producing a denial-of-service condition on the system providing QAT acceleration services.

The vulnerability is categorized under [CWE-476: NULL Pointer Dereference]. The attack vector is local, requires low attack complexity, and requires low privileges. The primary impact is on availability, with a minor confidentiality impact and no integrity impact, according to the published CVSS v4.0 metrics.

Root Cause

The root cause is missing pointer validation inside Intel QAT driver code paths invoked from user mode. A code path consumes a pointer obtained from internal state or from a request structure without verifying that the pointer is non-null. When the unexpected null condition occurs, the driver dereferences invalid memory and the calling thread or kernel-mode component fails. This pattern is consistent with insufficient input or state validation along an exposed IOCTL or user-callable interface.

Attack Vector

Exploitation requires local access and an authenticated user account on the target Windows system. The attacker runs an unprivileged user-mode program that issues specially crafted requests to the Intel QAT driver interface. No user interaction and no elevated privileges are required. The result is a denial-of-service condition affecting the QAT subsystem and any workloads depending on QAT acceleration, such as cryptographic offload, compression, or TLS termination services.

No public proof-of-concept has been published, no entries exist in Exploit-DB, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.012%, indicating a very low predicted likelihood of exploitation in the near term.

Detection Methods for CVE-2026-20771

Indicators of Compromise

Unexpected crashes or service interruptions in processes that offload work to Intel QAT (for example, TLS terminators, compression services, or cryptographic libraries linked against QAT engines).
Windows Event Log entries showing repeated faults or stop events referencing Intel QAT driver components (icp_qat*, qat*.sys).
Sudden disappearance or restart of QAT-backed acceleration services on hosts where unprivileged users are active.

Detection Strategies

Inventory Windows endpoints and servers for installed Intel QAT driver versions and flag any version below 1.13.
Correlate user-mode process executions with subsequent QAT driver faults to identify suspicious local DoS attempts.
Hunt for unprivileged processes issuing high volumes of IOCTL calls or device handle operations to QAT device objects.

Monitoring Recommendations

Forward Windows System and Application event logs to a centralized analytics platform and alert on repeated driver fault events tied to QAT components.
Monitor availability and restart counters of services that depend on QAT acceleration to detect denial-of-service patterns.
Track local logon activity on hosts that expose QAT to ensure only trusted users have interactive or service-level access.

How to Mitigate CVE-2026-20771

Immediate Actions Required

Update Intel QAT software drivers for Windows to version 1.13 or later on all affected hosts.
Identify systems running QAT-accelerated workloads and prioritize patching on multi-tenant or shared hosts where unprivileged users have local access.
Restrict interactive and remote logon to QAT-enabled Windows systems to trusted administrative accounts where feasible.

Patch Information

Intel has released fixed Intel QAT software drivers for Windows starting at version 1.13. Refer to the vendor advisory for download links and version details: Intel Security Advisory INTEL-SA-01387. Validate driver versions after deployment using Windows Device Manager or pnputil /enum-drivers and confirm the reported QAT driver version meets or exceeds 1.13.

Workarounds

Limit local logon rights on QAT-enabled hosts to reduce the population of users who can invoke the vulnerable driver interface.
Disable the Intel QAT driver on systems that do not actively require hardware acceleration until the patched driver is deployed.
Apply application allow-listing to prevent unauthorized user-mode binaries from interacting with QAT device objects.

bash

# Verify installed Intel QAT driver version on Windows
pnputil /enum-drivers | findstr /I "qat"

# Expected: Driver version 1.13 or later after remediation