CVE-2026-20782: Intel QAT Windows Driver DoS Vulnerability

CVE-2026-20782 is a buffer overflow denial of service vulnerability in Intel QuickAssist Technology drivers for Windows before version 1.13 that enables authenticated attackers to cause system unavailability. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-20782 Overview

CVE-2026-20782 is a buffer overflow vulnerability affecting Intel QuickAssist Technology (QAT) software drivers for Windows prior to version 1.13. The flaw resides in Ring 3 user-mode application code and is classified under CWE-120: Buffer Copy without Checking Size of Input. An authenticated local user with low privileges can trigger the overflow to cause a denial of service on the affected system. No user interaction is required, and the attack complexity is low. The vulnerability primarily impacts system availability, with limited effects on confidentiality and integrity. Intel addressed the issue in Intel Security Advisory SA-01387.

Critical Impact
Local authenticated attackers can trigger a buffer overflow in Intel QAT drivers to crash the system and cause denial of service.

Affected Products

Intel QuickAssist Technology (QAT) software drivers for Windows
All versions prior to 1.13
Systems running affected QAT user-mode components in Ring 3

Discovery Timeline

2026-05-12 - CVE-2026-20782 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-20782

Vulnerability Analysis

The vulnerability stems from an unchecked buffer copy operation in Intel QAT software drivers for Windows. QuickAssist Technology accelerates cryptographic and compression workloads, and its user-mode components expose interfaces accessible from Ring 3 applications. When input data exceeds the expected size, the driver writes past the bounds of an internal buffer. This memory corruption disrupts driver state and causes the affected process or service to terminate. The result is a denial of service condition on systems that depend on QAT for accelerated workloads such as TLS termination, VPN traffic processing, and storage compression.

Root Cause

The root cause is missing or insufficient bounds validation on input passed into a buffer within the QAT user-mode driver code path. The driver allocates a fixed-size buffer and copies attacker-controlled data without verifying that the source length fits the destination. This pattern aligns with CWE-120, the classic buffer copy weakness. Intel resolved the issue by introducing proper length checks in driver version 1.13.

Attack Vector

Exploitation requires local access and a valid authenticated user account on the target Windows system. The attacker invokes the vulnerable driver interface from a low-privileged user-mode process and supplies an oversized input. No special internal knowledge of the driver is required, and the attack does not depend on environmental preconditions. Successful exploitation crashes the driver or dependent services, producing high availability impact while exposing limited confidentiality and integrity effects on the vulnerable component.

No public proof-of-concept exploit is available for this vulnerability. Refer to Intel Security Advisory SA-01387 for vendor technical details.

Detection Methods for CVE-2026-20782

Indicators of Compromise

Unexpected crashes or restarts of Intel QAT driver services and dependent acceleration workloads
Windows Event Log entries indicating driver faults or kernel-mode exceptions originating from QAT components
Repeated process termination of services that offload cryptographic or compression operations to QAT

Detection Strategies

Inventory all Windows hosts running Intel QAT software and confirm driver version against 1.13
Monitor for abnormal user-mode invocations of QAT driver interfaces from non-administrative processes
Correlate availability incidents on QAT-dependent services with local user activity to identify potential abuse

Monitoring Recommendations

Enable Windows Error Reporting and forward driver crash telemetry to a central SIEM for correlation
Track installed driver versions across the fleet using endpoint management tooling and flag versions below 1.13
Alert on unexpected service restarts for workloads bound to QAT acceleration, such as IPsec, TLS proxies, and storage compression

How to Mitigate CVE-2026-20782

Immediate Actions Required

Identify all Windows systems with Intel QAT software drivers installed and verify the running version
Update affected drivers to version 1.13 or later as published by Intel
Restrict local logon rights on systems running QAT to reduce the pool of users who can trigger the flaw

Patch Information

Intel released a fixed driver in version 1.13. Administrators should obtain the updated package from Intel and deploy it to all affected Windows systems. Full details and download guidance are available in Intel Security Advisory SA-01387.

Workarounds

Limit local interactive and remote desktop access to trusted administrative users only
Disable or unload the QAT driver on systems that do not actively use QuickAssist acceleration until patching is complete
Apply application allowlisting to prevent untrusted user-mode binaries from interacting with QAT driver interfaces

bash

# Verify Intel QAT driver version on Windows (PowerShell)
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*QuickAssist*" } | Select-Object DeviceName, DriverVersion