CVE-2026-42917

Intel Neural Compressor deserialization could interrupt local processing (CVE-2026-42917)

Intel · Neural Compressor

First documented disclosure · Review checkpoint

Summary

Intel identifies deserialization of untrusted data in the model optimization software. The advisory does not identify the affected function. Processing could stop or become unreliable.

Severity and exploitation evidence

Medium · 4.8/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Intel identifies deserialization of untrusted data in the model optimization software. The advisory does not identify the affected function.

Conditions required

A locally authenticated user could exercise the affected processing path without another user’s involvement.

Potential impact

Processing could stop or become unreliable.

Affected versions and configurations

Before 3.8.

Fix and mitigation status

Intel recommends 3.8 or later for the advisory.

Practical next steps

Update Neural Compressor to 3.8 or later.

Operating lesson

Check the installed component and distribution channel when matching a model workload to a driver or library fix.

Evidence and limits

Intel lists this finding under a distinct CVE. The advisory describes the same weakness class and impact for several CVEs and does not identify their individual code paths.

Sources