This vulnerability is caused by improper input validation in Intel QAT software drivers for Windows prior to version 2.6. An unprivileged local user who is authenticated can construct malicious input that causes a crash or other failure in ring‑3 code, resulting in a denial of service. The flaw does not require delegated privileges or user interaction, and it can be exercised simply by sending the driver malformed data.

Intel QAT software drivers for Windows, versions earlier than 2.6.

The CVSS score of 6.9 indicates moderate severity, with a low impact on confidentiality and integrity but a high impact on availability. The EPSS score is not available, so the current exploitation probability is unknown; however, the vulnerability is listed as not included in KEV, suggesting no documented, active exploitation. The attack vector is inferred to be local, requiring authenticated, low‑complexity input from an unprivileged user. Successful exploitation would halt cryptographic or application services that rely on QAT, potentially affecting critical workloads.