Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation… (CVE-2026-20913)

CVE-2026-20913 describes an improper input validation vulnerability in Intel Neural Compressor software prior to version 3.7. This flaw exists within Ring 3 user applications and could allow an authenticated, unprivileged local adversary to escalate privileges. The attack complexity is low, and no user interaction is required. The vulnerability affects confidentiality, integrity, and availability at a low level, but does not lead to further system-wide impacts. No known exploits are reported in the wild, and the vulnerability is rated medium severity with a CVSS 3.1 score of 5.3.

An authenticated local user with low privileges may exploit this vulnerability to gain higher privileges on the affected system. The impact on confidentiality, integrity, and availability is low, and no further system-wide compromise is indicated. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, limit local access to trusted users and monitor for suspicious activity related to Intel Neural Compressor software.