CVE-2026-40065

Input validation in Neural Compressor could allow privilege escalation

Intel · Neural Compressor

First documented disclosure · Review checkpoint

Summary

Intel identifies input validation in the model optimization software. The advisory does not identify the affected function. The caller could acquire additional local privileges.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Intel identifies input validation in the model optimization software. The advisory does not identify the affected function.

Conditions required

Intel describes a local attack that also involves a privileged user and passive interaction.

Potential impact

The caller could acquire additional local privileges.

Affected versions and configurations

Intel identifies versions before 3.7 for this CVE.

Fix and mitigation status

Intel recommends 3.8 or later for the advisory.

Practical next steps

Update Neural Compressor to 3.8 or later.

Operating lesson

Check the installed component and distribution channel when matching a model workload to a driver or library fix.

Evidence and limits

The CVE record was published on 2026-11-10.

Sources