CVE-2026-20782: Intel QAT Windows Driver DoS Vulnerability

CVE-2026-20782 Overview

CVE-2026-20782 is a buffer overflow vulnerability affecting Intel QuickAssist Technology (QAT) software drivers for Windows prior to version 1.13. The flaw resides in Ring 3 user-mode application code and is classified under CWE-120: Buffer Copy without Checking Size of Input. An authenticated local user with low privileges can trigger the overflow to cause a denial of service on the affected system. No user interaction is required, and the attack complexity is low. The vulnerability primarily impacts system availability, with limited effects on confidentiality and integrity. Intel addressed the issue in Intel Security Advisory SA-01387.

Critical Impact

Local authenticated attackers can trigger a buffer overflow in Intel QAT drivers to crash the system and cause denial of service.

Affected Products

• Intel QuickAssist Technology (QAT) software drivers for Windows
• All versions prior to 1.13
• Systems running affected QAT user-mode components in Ring 3

Discovery Timeline

• 2026-05-12 - CVE-2026-20782 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-20782

Vulnerability Analysis

The vulnerability stems from an unchecked buffer copy operation in Intel QAT software drivers for Windows. QuickAssist Technology accelerates cryptographic and compression workloads, and its user-mode components expose interfaces accessible from Ring 3 applications. When input data exceeds the expected size, the driver writes past the bounds of an internal buffer. This memory corruption disrupts driver state and causes the affected process or service to terminate. The result is a denial of service condition on systems that depend on QAT for accelerated workloads such as TLS termination, VPN traffic processing, and storage compression.

Root Cause

The root cause is missing or insufficient bounds validation on input passed into a buffer within the QAT user-mode driver code path. The driver allocates a fixed-size buffer and copies attacker-controlled data without verifying that the source length fits the destination. This pattern aligns with CWE-120, the classic buffer copy weakness. Intel resolved the issue by introducing proper length checks in driver version 1.13.

Attack Vector

Exploitation requires local access and a valid authenticated user account on the target Windows system. The attacker invokes the vulnerable driver interface from a low-privileged user-mode process and supplies an oversized input. No special internal knowledge of the driver is required, and the attack does not depend on environmental preconditions. Successful exploitation crashes the driver or dependent services, producing high availability impact while exposing limited confidentiality and integrity effects on the vulnerable component.

No public proof-of-concept exploit is available for this vulnerability. Refer to Intel Security Advisory SA-01387 for vendor technical details.

Detection Methods for CVE-2026-20782

Indicators of Compromise

• Unexpected crashes or restarts of Intel QAT driver services and dependent acceleration workloads
• Windows Event Log entries indicating driver faults or kernel-mode exceptions originating from QAT components
• Repeated process termination of services that offload cryptographic or compression operations to QAT

Detection Strategies

• Inventory all Windows hosts running Intel QAT software and confirm driver version against 1.13
• Monitor for abnormal user-mode invocations of QAT driver interfaces from non-administrative processes
• Correlate availability incidents on QAT-dependent services with local user activity to identify potential abuse

Monitoring Recommendations

• Enable Windows Error Reporting and forward driver crash telemetry to a central SIEM for correlation
• Track installed driver versions across the fleet using endpoint management tooling and flag versions below 1.13
• Alert on unexpected service restarts for workloads bound to QAT acceleration, such as IPsec, TLS proxies, and storage compression

How to Mitigate CVE-2026-20782

Immediate Actions Required

• Identify all Windows systems with Intel QAT software drivers installed and verify the running version
• Update affected drivers to version 1.13 or later as published by Intel
• Restrict local logon rights on systems running QAT to reduce the pool of users who can trigger the flaw

Patch Information

Intel released a fixed driver in version 1.13. Administrators should obtain the updated package from Intel and deploy it to all affected Windows systems. Full details and download guidance are available in Intel Security Advisory SA-01387.

Workarounds

• Limit local interactive and remote desktop access to trusted administrative users only
• Disable or unload the QAT driver on systems that do not actively use QuickAssist acceleration until patching is complete
• Apply application allowlisting to prevent untrusted user-mode binaries from interacting with QAT driver interfaces

# Verify Intel QAT driver version on Windows (PowerShell)
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*QuickAssist*" } | Select-Object DeviceName, DriverVersion