The flaw originates from an improper conditions check in certain firmware components of Intel’s NPU drivers that can be triggered by an unprivileged local process with an authenticated session. An attacker can exploit the issue with low complexity and no special knowledge or user interaction, resulting in a denial of service that disrupts the NPU subsystem. The impact is a high loss of availability, with no confidential information disclosed and only a low risk to integrity.

This vulnerability affects Intel NPU driver firmware on devices that employ the Intel(R) NPU Drivers. No specific product or firmware versions were disclosed in the advisory, so all installations of the Intel NPU drivers that rely on the identified firmware paths are potentially at risk.

The CVSS score is 6.9, reflecting a moderate to high severity due to local impact and moderate exploitation complexity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not yet a widely cited exploit. The likely attack vector is local because the attacker must have an authenticated user session on the machine; however, the exploit requires no user interaction, which increases the risk for unattended systems. Overall, the vulnerability represents a moderate risk that can cause service downtime if an attacker gains local access.