The bug is a null pointer dereference that can be triggered on Intel QAT software drivers for Windows when code runs at user level (Ring 3). Exploiting the flaw can cause the driver to crash and kill the parent application or the entire system, resulting in a denial of service. The flaw does not affect confidentiality or integrity. The root cause is a missing null‑check (CWE‑476).

Impacted components are Intel QAT driver packages for Windows with versions prior to 2.6.0. Users of older Intel QAT driver releases are potentially exposed.

The CVSS rating of 6.8 signals a moderate severity issue. EPSS is not available, and the flaw is not listed in the CISA KEV catalog. Attack conditions are low complexity: an authenticated local user can exercise the flaw without needing elevated privileges or remote access. Attackers would need to run a user‑level program that interacts with the driver. An unauthenticated attacker cannot trigger the failure without privileged access. Consequently, the risk is moderate and the vulnerability is most relevant to environments where Intel QAT drivers are deployed and the system is used by untrusted local users.