CVE-2025-31937
📋 TL;DR
An out-of-bounds read vulnerability in Intel QAT Windows software before version 2.6.0 allows authenticated local attackers to cause denial of service. The vulnerability requires high complexity exploitation and affects systems running vulnerable Intel QuickAssist Technology software on Windows.
💻 Affected Systems
- Intel QuickAssist Technology (QAT) Windows software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system denial of service through local access, potentially crashing affected services or the entire system.
Likely Case
Local authenticated user causes service disruption or system instability through targeted exploitation.
If Mitigated
Minimal impact with proper access controls limiting local user privileges and monitoring for abnormal system behavior.
🎯 Exploit Status
Exploitation requires authenticated local access and high complexity attack. No public exploit code known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.0 or later
Vendor Advisory: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01373.html
Restart Required: Yes
Instructions:
1. Download Intel QAT software version 2.6.0 or later from Intel's website. 2. Install the update following Intel's installation guide. 3. Restart the system to complete the installation.
🔧 Temporary Workarounds
Restrict local user access
windowsLimit local user privileges to reduce attack surface
Monitor system stability
windowsImplement monitoring for system crashes or abnormal behavior in QAT services
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor system logs for abnormal QAT service behavior or crashes
🔍 How to Verify
Check if Vulnerable:
Check Intel QAT software version in Windows Programs and Features or via command line: wmic product where name like '%Intel%QAT%' get versionCheck Version:
wmic product where name like '%Intel%QAT%' get versionVerify Fix Applied:
Verify installed version is 2.6.0 or later using same version check command📡 Detection & Monitoring
Log Indicators:
- System crashes, application errors related to QAT services, abnormal termination of QAT processes
Network Indicators:
- None - local vulnerability only
SIEM Query:
EventID=1000 OR EventID=1001 OR EventID=41 AND Source contains 'QAT' OR Process contains 'qat'