Intel QAT software drivers for Windows before version 1.13 contain an improper input validation that can be exploited by a local, authenticated user to trigger a denial of service. The flaw resides in Ring 3 code and does not require user interaction or elevated privileges. When the vulnerability is successfully triggered, system availability is disrupted, while confidentiality and integrity remain unaffected.

All Windows systems that employ Intel QAT drivers prior to version 1.13 are impacted. The drivers are installed as part of the Intel QuickAssist Technology (QAT) software and are used by applications that require accelerated cryptographic or compression operations.

The CVSS score of 6.9 labels the vulnerability as moderate. EPSS information is not available and the flaw is not listed in CISA’s KEV catalog, indicating lower observed exploitation activity. The attack vector is local. An adversary must be authenticated on the target machine, but no special internal knowledge is required; the attack complexity is low. Successful exploitation would cause a local denial of service, limiting the impact to the compromised user’s system alone, with no direct effect on confidentiality or integrity.