CVE-2025-20106

What it is

Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolkits before version 2025.0. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account, but needs a user to act. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-02-10 17:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 08:40 UTC Last updatedMost recent change to the record

Details

Published

2026-02-10 17:16 UTC

Last modified

2026-06-17 08:40 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-427

Record status

Deferred

Attack profile CVSS 4.0 · 5.4

Attack vector

Local

Complexity

High

Attack requirements

Present

Privileges needed

Low

User interaction

Active

Confidentiality

High

Integrity

High

Availability

High