CVE-2025-27710
📋 TL;DR
This vulnerability in Intel QAT Windows software allows authenticated local users to potentially read sensitive information from memory. It affects systems running vulnerable versions of Intel QAT software on Windows, requiring local access but no special privileges.
💻 Affected Systems
- Intel Quick Assist Technology (QAT) Windows software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could read sensitive data from kernel memory, potentially exposing encryption keys, passwords, or other confidential information.
Likely Case
Local authenticated users could read portions of memory they shouldn't have access to, potentially exposing application data or system information.
If Mitigated
With proper access controls and patching, the risk is limited to authorized users who would already have some level of system access.
🎯 Exploit Status
Requires authenticated local access. Attack complexity is described as low in the CVE description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.0 or later
Vendor Advisory: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01373.html
Restart Required: Yes
Instructions:
1. Download Intel QAT software version 2.6.0 or later from Intel's website
2. Stop any applications using QAT
3. Install the updated software
4. Restart the system
🔧 Temporary Workarounds
Restrict local access
windowsLimit local user access to systems running vulnerable QAT software
🧯 If You Can't Patch
- Implement strict access controls to limit which users can log into affected systems
- Monitor for unusual memory access patterns or information disclosure attempts
🔍 How to Verify
Check if Vulnerable:
Check Intel QAT software version in Windows Programs and Features or via command line: wmic product where "name like '%Intel%QAT%'" get versionCheck Version:
wmic product where "name like '%Intel%QAT%'" get versionVerify Fix Applied:
Verify installed version is 2.6.0 or higher using the same command📡 Detection & Monitoring
Log Indicators:
- Unusual memory access patterns
- Failed attempts to access protected memory regions
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Windows Event ID 4656 (Handle to an object was requested) with QAT-related processes