This vulnerability in Intel(R) QuickAssist Adapter 8960 software before version 1.13 allows an unprivileged authenticated user to escalate privileges via an untrusted pointer dereference in Ring 3 user applications. The attack requires local access and no user interaction, with low complexity. The CVSS 4.0 vector indicates local attack vector, low attack complexity, no attack prerequisites, privileges required are low, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published and assigned CVE-2026-20738 but lacks an official remediation level or patch information from the vendor. No cloud service is involved, and no known exploits have been reported.

Successful exploitation could allow an authenticated local user with low privileges to escalate their privileges, potentially compromising the confidentiality, integrity, and availability of the affected system at a high level. However, there are no known exploits in the wild, and the vulnerability requires local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for unusual privilege escalation attempts. Do not assume the vulnerability is mitigated without vendor confirmation.