CVE-2025-20056

Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01355.html

Configurations

No configuration.

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) La validación de entrada inadecuada para algunas versiones de Intel VTune Profiler anteriores a la versión 2025.1 dentro del Anillo 3: Aplicaciones de Usuario puede permitir una escalada de privilegios. Un adversario de software sin privilegios con un usuario autenticado, combinado con un ataque de baja complejidad, puede permitir la manipulación de datos. Este resultado puede ocurrir potencialmente a través de acceso local cuando los requisitos de ataque no están presentes, sin conocimiento interno especial y no requiere interacción del usuario. La potencial vulnerabilidad puede impactar la confidencialidad (ninguna), integridad (baja) y disponibilidad (baja) del sistema vulnerable, resultando en impactos posteriores en la confidencialidad (ninguna), integridad (ninguna) y disponibilidad (ninguna) del sistema.

Information

Published : 2025-11-11 17:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-20056

Mitre link : CVE-2025-20056

CVE.ORG link : CVE-2025-20056

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-20056", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20056", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T14:53:49.025565Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secure@intel.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "secure@intel.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "secure@intel.com", "affectedData": [{"vendor": "n/a", "product": "Intel VTune Profiler", "versions": [{"status": "affected", "version": "before version 2025.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-11T17:15:40.170", "references": [{"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01355.html", "source": "secure@intel.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secure@intel.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}, {"lang": "es", "value": "La validaci\u00f3n de entrada inadecuada para algunas versiones de Intel VTune Profiler anteriores a la versi\u00f3n 2025.1 dentro del Anillo 3: Aplicaciones de Usuario puede permitir una escalada de privilegios. Un adversario de software sin privilegios con un usuario autenticado, combinado con un ataque de baja complejidad, puede permitir la manipulaci\u00f3n de datos. Este resultado puede ocurrir potencialmente a trav\u00e9s de acceso local cuando los requisitos de ataque no est\u00e1n presentes, sin conocimiento interno especial y no requiere interacci\u00f3n del usuario. La potencial vulnerabilidad puede impactar la confidencialidad (ninguna), integridad (baja) y disponibilidad (baja) del sistema vulnerable, resultando en impactos posteriores en la confidencialidad (ninguna), integridad (ninguna) y disponibilidad (ninguna) del sistema."}], "lastModified": "2026-10-19T13:10:00.110", "sourceIdentifier": "secure@intel.com"}