CVE-2025-27712: Low severity Intel Neural Compressor vulnerability
Improper neutralization for some Intel(R) Neural Compressor software before version v3.4 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Intel(R) Neural Compressorto a version that resolves this vulnerability.Fixed in v3.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27712?
CVE-2025-27712 has a high severity due to the potential escalation of privilege for unprivileged software.
How do I fix CVE-2025-27712?
To fix CVE-2025-27712, upgrade Intel Neural Compressor to version 3.4 or later.
Who is affected by CVE-2025-27712?
CVE-2025-27712 affects users of Intel Neural Compressor software prior to version 3.4.
What kind of attack is enabled by CVE-2025-27712?
CVE-2025-27712 may allow an authenticated user to execute a low complexity attack for privilege escalation.
Is there a workaround for CVE-2025-27712?
Currently, the best mitigation for CVE-2025-27712 is to update to the latest version of Intel Neural Compressor.