CVE-2026-20793: Intel QAT Software Driver DoS Vulnerability

CVE-2026-20793 Overview

CVE-2026-20793 affects Intel Quickassist Technology (QAT) software drivers for Windows before version 1.13. The flaw stems from an unchecked return value [CWE-252] in Ring 3 user-mode application code. An authenticated local attacker with low privileges can trigger a denial-of-service condition without user interaction. The vulnerability impacts only availability and does not expose data confidentiality or integrity. Intel published advisory INTEL-SA-01387 to address the issue.

Critical Impact

A local authenticated user can cause a denial-of-service in Intel QAT user-mode driver components on Windows, disrupting cryptographic acceleration services that depend on QAT.

Affected Products

• Intel Quickassist Technology software drivers for Windows before version 1.13
• Windows systems running Ring 3 user applications that depend on Intel QAT acceleration
• Workloads using Intel QAT for cryptography, compression, or data movement offload

Discovery Timeline

• 2026-05-12 - CVE-2026-20793 published to NVD
• 2026-05-15 - Last updated in NVD database
• Intel published Intel Security Advisory SA-01387 documenting the issue

Technical Details for CVE-2026-20793

Vulnerability Analysis

The vulnerability is classified under [CWE-252]: Unchecked Return Value. Intel QAT user-mode driver code on Windows calls one or more functions but fails to validate the returned status before continuing execution. When a called routine fails and returns an error or unexpected value, the driver path proceeds with invalid state. This can lead to an unhandled error condition that terminates the user-mode process or destabilizes QAT-dependent services. The defect resides in Ring 3 user space rather than the kernel, which limits direct system-wide impact. However, applications that rely on QAT for cryptographic offload or compression may stop functioning when the user-mode driver component fails.

Root Cause

The root cause is a missing return-value check inside the Intel QAT user-mode driver for Windows. Developers omitted error-state handling for at least one downstream API call. When that call returns an error condition, subsequent operations consume the failed result without validation. The omission violates defensive coding practices for system software that exposes interfaces to unprivileged callers.

Attack Vector

Exploitation requires local access and an authenticated user account with low privileges. No user interaction is needed. An attacker submits crafted inputs through the QAT user-mode interface to drive the driver into the code path containing the unchecked call. When the call fails, the driver continues with invalid state and crashes or hangs. The impact is limited to availability of QAT-accelerated services on the affected host. No code execution or data disclosure occurs through this defect alone. See the Intel Security Advisory SA-01387 for the vendor description.

Detection Methods for CVE-2026-20793

Indicators of Compromise

• Unexpected termination or repeated restarts of Intel QAT user-mode driver processes on Windows hosts
• Windows Application event log entries indicating crashes in QAT driver components or dependent services
• Sudden drop in QAT-accelerated throughput for cryptography or compression workloads
• Local low-privileged processes repeatedly invoking QAT user-mode interfaces before service failure

Detection Strategies

• Inventory Windows endpoints and servers for Intel QAT driver versions and flag any installation prior to 1.13
• Monitor Windows Error Reporting and Application crash telemetry for QAT-related modules
• Correlate local process activity that interacts with QAT user-mode interfaces against process crashes that follow within a short window
• Use endpoint detection telemetry to track repeated low-privilege invocations of QAT driver components from unexpected user contexts

Monitoring Recommendations

• Forward Windows Application and System event logs to a centralized analytics platform for crash pattern analysis
• Alert on repeated faults in QAT driver modules from the same user session or process tree
• Track Intel QAT driver version drift across the fleet and alert when unpatched versions are detected
• Baseline QAT service availability and alert on availability degradation outside normal operational variance

How to Mitigate CVE-2026-20793

Immediate Actions Required

• Upgrade Intel QAT software drivers for Windows to version 1.13 or later on all affected hosts
• Identify systems running QAT-accelerated workloads and prioritize them for patching first
• Restrict local logon and interactive user rights on systems exposing QAT interfaces to reduce the population of accounts capable of triggering the defect
• Review application dependencies on QAT to plan controlled service restarts after patch deployment

Patch Information

Intel released a fixed driver in version 1.13 of the Intel QAT software drivers for Windows. Refer to Intel Security Advisory SA-01387 for download links and version-specific guidance. Apply the update through your standard driver deployment workflow and validate that QAT-dependent services resume normal operation after installation.

Workarounds

• Limit interactive and local logon rights on systems running vulnerable QAT drivers until patching is complete
• Disable Intel QAT acceleration in dependent applications if patching cannot be performed immediately and a software fallback is available
• Apply least-privilege controls so that only required service accounts can invoke QAT user-mode interfaces

# Configuration example: query installed Intel QAT driver version on Windows
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*QuickAssist*" } | Select-Object DeviceName, DriverVersion, DriverDate