CVE-2025-14596
📋 TL;DR
This CVE describes a Search Order Hijacking vulnerability in Altera Quartus Prime Pro Installer on Windows. Attackers can place malicious DLLs in directories searched before legitimate ones, potentially executing arbitrary code when the installer runs. This affects Quartus Prime Pro users on Windows versions 24.1 through 24.3.1.
💻 Affected Systems
- Altera Quartus Prime Pro Installer (SFX)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary code execution with installer privileges, potentially leading to persistence, data theft, or lateral movement.
Likely Case
Local privilege escalation or malware execution in the context of the user running the installer, potentially compromising the development environment.
If Mitigated
Limited impact if proper file permissions and execution controls prevent unauthorized DLL placement in search paths.
🎯 Exploit Status
Exploitation requires ability to place malicious DLLs in directories searched before legitimate ones during installer execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.3.2 or later
Vendor Advisory: https://www.altera.com/security/security-advisory/asa-0004
Restart Required: No
Instructions:
1. Download Quartus Prime Pro version 24.3.2 or later from official Intel/Altera website. 2. Uninstall affected versions (24.1-24.3.1). 3. Install patched version. 4. Verify installation completes without errors.
🔧 Temporary Workarounds
Restrict DLL search paths
windowsUse Windows policies or application controls to restrict DLL search order and prevent loading from untrusted directories
Use Windows AppLocker or Software Restriction Policies to block DLL execution from user-writable directories
Secure installer directories
windowsSet strict permissions on directories where installer runs to prevent unauthorized DLL placement
icacls "C:\Program Files\IntelFPGA_pro" /deny Users:(OI)(CI)W
icacls "%TEMP%" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Run installer only from trusted, secured directories with restricted write permissions
- Use virtualization/containerization to isolate Quartus installation from critical systems
🔍 How to Verify
Check if Vulnerable:
Check Quartus Prime Pro version: Open Quartus Prime, go to Help > About, verify version is between 24.1 and 24.3.1 inclusiveCheck Version:
reg query "HKLM\SOFTWARE\Intel\Quartus Prime" /v VersionVerify Fix Applied:
Confirm installed version is 24.3.2 or later in Help > About dialog📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing DLL loading from unexpected directories during Quartus installation
- Process Monitor logs showing DLL search order hijacking attempts
Network Indicators:
- Not applicable - local exploitation only
SIEM Query:
EventID=7 OR EventID=11 AND ProcessName contains "quartus" AND ImageLoaded contains ".dll" AND NOT ImageLoaded contains "System32"