Protection mechanism failure in Intel oneCCL Bindings for PyTorch allows unprivileged software to gain elevated privileges when combined with a privileged user and local access. The flaw, identified as CWE‑693, can compromise confidentiality, integrity, and availability of the affected system by fully empowering the attacker.

Vulnerable releases are all versions of Intel oneCCL Bindings for PyTorch prior to v2.8.0. The issue is confined to Ring 3 user applications and is part of Intel’s data‑parallel libraries used with PyTorch in high‑performance computing environments.

The CVSS score of 5.4 indicates moderate risk while the EPSS score of less than 1 % suggests a low likelihood of exploitation as of now. Exploitation can occur via local access with a privileged user and requires only passive user interaction, making it a low‑complexity attack. Although it is not listed in CISA’s KEV catalog, the potential for privilege escalation warrants attention by security teams.