Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-20622: Intel NPU Driver for Windows: Sensitive Data Leaked to Unprivileged Users

CVE-2025-20622 · published 11 months ago

Summary

Some older versions of Intel's NPU drivers for Windows may leak sensitive information to unprivileged users, allowing an attacker with local access to access data they shouldn't see. This is a concern because it could lead to unauthorized access to sensitive data. To stay safe, update your Intel NPU drivers to the latest version (32.0.100.4023 or later).

Original advisory text

Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

References

https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01304.html

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.0 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-226Sensitive Information in Resource Not Removed Before Reuse

Timeline

Published11 Nov 2025

Updated26 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-20622 · NVD

Track software like this

Free during beta